Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
AyBhhRZXPj

Overview

General Information

Sample Name:AyBhhRZXPj (renamed file extension from none to dll)
Analysis ID:595303
MD5:518cc4a9888e76bc1a916fd67a08a075
SHA1:148d6f12f12a0cae195f36f4319839f6687b7144
SHA256:57b0d95f62fc7999dd21b6a0aef4087ad855ccb2d28b99463ee6c88ddf037009
Tags:Dridexexe
Infos:

Detection

Dridex
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes memory attributes in foreign processes to executable or writable
Machine Learning detection for sample
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Call by Ordinal
Machine Learning detection for dropped file
Uses Atom Bombing / ProGate to inject into other processes
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the installation date of Windows
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Installs a raw input device (often for capturing keystrokes)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Found evasive API chain checking for process token information
Binary contains a suspicious time stamp
PE file contains more sections than normal
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)
Contains functionality to simulate mouse events
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Classification

  • System is w10x64
  • loaddll64.exe (PID: 6608 cmdline: loaddll64.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6620 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 6640 cmdline: rundll32.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6632 cmdline: rundll32.exe C:\Users\user\Desktop\AyBhhRZXPj.dll,ApplyCompatResolutionQuirking MD5: 73C519F050C20580F8A62C849D49215A)
      • explorer.exe (PID: 3968 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • Magnify.exe (PID: 5372 cmdline: C:\Windows\system32\Magnify.exe MD5: F97BE20B374457236666607EE4BA7F7F)
        • FileHistory.exe (PID: 5788 cmdline: C:\Windows\system32\FileHistory.exe MD5: 989B5BDB2BEAC9F894BBC236F1B67967)
        • FileHistory.exe (PID: 7004 cmdline: C:\Users\user\AppData\Local\u70W8\FileHistory.exe MD5: 989B5BDB2BEAC9F894BBC236F1B67967)
        • RdpSa.exe (PID: 7028 cmdline: C:\Windows\system32\RdpSa.exe MD5: 0795B6F790F8E52D55F39E593E9C5BBA)
        • mspaint.exe (PID: 7064 cmdline: C:\Windows\system32\mspaint.exe MD5: 99F86A0D360FD9A3FCAD6B1E7D92A90C)
        • mspaint.exe (PID: 4576 cmdline: C:\Users\user\AppData\Local\NYpervHTp\mspaint.exe MD5: 99F86A0D360FD9A3FCAD6B1E7D92A90C)
        • mmc.exe (PID: 6244 cmdline: C:\Windows\system32\mmc.exe MD5: BA80301974CC8C4FB9F3F9DDB5905C30)
        • EaseOfAccessDialog.exe (PID: 6176 cmdline: C:\Windows\system32\EaseOfAccessDialog.exe MD5: F87F2E5EBF3FFBA39DF1621B5F8689B5)
        • unregmp2.exe (PID: 4948 cmdline: C:\Windows\system32\unregmp2.exe MD5: 9B517303C58CA8A450B97B0D71594CBB)
        • unregmp2.exe (PID: 4908 cmdline: C:\Users\user\AppData\Local\vVin\unregmp2.exe MD5: 9B517303C58CA8A450B97B0D71594CBB)
        • omadmclient.exe (PID: 6340 cmdline: C:\Windows\system32\omadmclient.exe MD5: AD7C6CD7A8EEC95808AA77C5D7987941)
        • omadmclient.exe (PID: 6392 cmdline: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exe MD5: AD7C6CD7A8EEC95808AA77C5D7987941)
        • eudcedit.exe (PID: 6164 cmdline: C:\Windows\system32\eudcedit.exe MD5: 0ED10F2F98B80FF9F95EED2B04CFA076)
        • GamePanel.exe (PID: 5244 cmdline: C:\Windows\system32\GamePanel.exe MD5: 4EF330EFAE954723B1F2800C15FDA7EB)
        • GamePanel.exe (PID: 5832 cmdline: C:\Users\user\AppData\Local\Odp\GamePanel.exe MD5: 4EF330EFAE954723B1F2800C15FDA7EB)
    • rundll32.exe (PID: 6724 cmdline: rundll32.exe C:\Users\user\Desktop\AyBhhRZXPj.dll,CompatString MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6868 cmdline: rundll32.exe C:\Users\user\Desktop\AyBhhRZXPj.dll,CompatValue MD5: 73C519F050C20580F8A62C849D49215A)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
00000003.00000002.254650738.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
    00000000.00000002.274237724.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
      00000008.00000002.268092209.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
        00000023.00000002.497477137.00007FFC74C21000.00000020.00000001.01000000.00000010.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
          00000005.00000002.260480210.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
            Click to see the 5 entries
            SourceRuleDescriptionAuthorStrings
            8.2.rundll32.exe.7ffc670c0000.2.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
              35.2.unregmp2.exe.7ffc74c20000.3.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                21.2.FileHistory.exe.7ffc74c20000.3.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                  37.2.omadmclient.exe.7ffc74c20000.3.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                    5.2.rundll32.exe.7ffc670c0000.2.unpackJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
                      Click to see the 5 entries

                      System Summary

                      barindex
                      Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll",#1, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6620, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\AyBhhRZXPj.dll",#1, ProcessId: 6640
                      Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\explorer.exe, ProcessId: 3968, TargetFilename: C:\Users\user\AppData\Local\u70W8\FileHistory.exe

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Source: AyBhhRZXPj.dllVirustotal: Detection: 70%Perma Link
                      Source: AyBhhRZXPj.dllMetadefender: Detection: 62%Perma Link
                      Source: AyBhhRZXPj.dllReversingLabs: Detection: 88%
                      Source: AyBhhRZXPj.dllAvira: detected
                      Source: C:\Users\user\AppData\Local\Odp\dwmapi.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen7
                      Source: C:\Users\user\AppData\Local\u70W8\UxTheme.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\NYpervHTp\MFC42u.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\iv505rrw\XmlLite.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen7
                      Source: C:\Users\user\AppData\Local\pkru2Wsoo\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\pkru2Wsoo\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: C:\Users\user\AppData\Local\QpruqOk1\DUI70.dllAvira: detection malicious, Label: TR/Crypt.XPACK.Gen4
                      Source: C:\Users\user\AppData\Local\rgsL2C4\WTSAPI32.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                      Source: AyBhhRZXPj.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Odp\dwmapi.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\u70W8\UxTheme.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\NYpervHTp\MFC42u.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\iv505rrw\XmlLite.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\pkru2Wsoo\VERSION.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\pkru2Wsoo\VERSION.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\QpruqOk1\DUI70.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\rgsL2C4\WTSAPI32.dllJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA5C7B8 CryptDecryptMessage,GetLastError,LocalAlloc,CryptDecryptMessage,GetLastError,LocalFree,37_2_00007FF6BFA5C7B8
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA43EE8 CryptAcquireContextW,GetLastError,CryptReleaseContext,SetLastError,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptCreateHash,GetLastError,CryptCreateHash,CryptHashData,CryptGetHashParam,GetLastError,EncodeBase64,CryptHashData,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,GetLastError,EncodeBase64W,CryptHashData,CryptGetHashParam,GetLastError,EncodeBase64W,LocalFree,??_V@YAXPEAX@Z,CryptDestroyHash,CryptDestroyHash,CryptDestroyHash,CryptReleaseContext,37_2_00007FF6BFA43EE8
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA44540 CryptAcquireContextW,GetLastError,CryptReleaseContext,SetLastError,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptCreateHash,CryptHashData,CryptGetHashParam,GetLastError,EncodeBase64,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,GetLastError,EncodeBase64W,??_V@YAXPEAX@Z,CryptDestroyHash,CryptDestroyHash,CryptReleaseContext,37_2_00007FF6BFA44540
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA5C5A8 memset,CryptEncryptMessage,GetLastError,LocalAlloc,CryptEncryptMessage,GetLastError,LocalFree,37_2_00007FF6BFA5C5A8
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA44528 CryptDestroyHash,37_2_00007FF6BFA44528
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA4450C CryptReleaseContext,37_2_00007FF6BFA4450C
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA5C3D8 CryptVerifyMessageSignature,GetLastError,LocalAlloc,CryptVerifyMessageSignature,GetLastError,LocalFree,37_2_00007FF6BFA5C3D8
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA55260 CryptAcquireContextW,GetLastError,CryptReleaseContext,SetLastError,CryptAcquireContextW,GetLastError,LocalAlloc,CryptGenRandom,GetLastError,LocalFree,CryptReleaseContext,37_2_00007FF6BFA55260
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA5C1CC memset,CryptSignMessage,GetLastError,LocalAlloc,CryptSignMessage,GetLastError,LocalFree,37_2_00007FF6BFA5C1CC
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA5BA30 CryptHashCertificate,GetLastError,37_2_00007FF6BFA5BA30
                      Source: C:\Users\user\AppData\Local\iv505rrw\omadmclient.exeCode function: 37_2_00007FF6BFA449A8 UnicodeToMB,CryptHashData,GetLastError,??_V@YAXPEAX@Z,37_2_00007FF6BFA449A8
                      Source: C:\Users\user\AppData\Local\Odp\GamePanel.exeCode function: 41_2_00007FF76CA68598 CryptAcquireContextW,CryptCreateHash,41_2_00007FF76CA68598
                      Source: C:\Users\user\AppData\Local\Odp\GamePanel.exeCode function: 41_2_00007FF76CA68610 CryptGetHashParam,memset,41_2_00007FF76CA68610
                      Source: C:\Users\user\AppData\Local\Odp\GamePanel.exeCode function: 41_2_00007FF76CA68534 CryptDestroyHash,CryptReleaseContext,41_2_00007FF76CA68534
                      Source: C:\Users\user\AppData\Local\Odp\GamePanel.exeCode function: 41_2_00007FF76CA6874C CryptHashData,41_2_00007FF76CA6874C
                      Source: C:\Users\user\AppData\Local\Odp\GamePanel.exeCode function: 41_2_00007FF76CA688F8 CryptHashData,41_2_00007FF76CA688F8
                      Source: AyBhhRZXPj.dllStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
                      Source: Binary string: mspaint.pdb source: mspaint.exe, 00000019.00000000.419578288.00007FF6EFB78000.00000002.00000001.01000000.0000000D.sdmp, mspaint.exe, 00000019.00000002.455682881.00007FF6EFB78000.00000002.00000001.01000000.0000000D.sdmp
                      Source: Binary string: mspaint.pdbGCTL source: mspaint.exe, 00000019.00000000.419578288.00007FF6EFB78000.00000002.00000001.01000000.0000000D.sdmp, mspaint.exe, 00000019.00000002.455682881.00007FF6EFB78000.00000002.00000001.01000000.0000000D.sdmp
                      Source: Binary string: unregmp2.pdb source: unregmp2.exe, 00000023.00000002.497335098.00007FF67255B000.00000002.00000001.01000000.0000000F.sdmp, unregmp2.exe, 00000023.00000000.466778419.00007FF67255B000.00000002.00000001.01000000.0000000F.sdmp
                      Source: Binary string: GamePanel.pdbGCTL source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp
                      Source: Binary string: FileHistory.pdbGCTL source: FileHistory.exe, 00000015.00000000.378208348.00007FF6811E9000.00000002.00000001.01000000.00000009.sdmp, FileHistory.exe, 00000015.00000002.383485917.00007FF6811E9000.00000002.00000001.01000000.00000009.sdmp
                      Source: Binary string: unregmp2.pdbGCTL source: unregmp2.exe, 00000023.00000002.497335098.00007FF67255B000.00000002.00000001.01000000.0000000F.sdmp, unregmp2.exe, 00000023.00000000.466778419.00007FF67255B000.00000002.00000001.01000000.0000000F.sdmp
                      Source: Binary string: GamePanel.pdb source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp
                      Source: Binary string: omadmclient.pdb source: omadmclient.exe, 00000025.00000000.504473008.00007FF6BFA68000.00000002.00000001.01000000.00000011.sdmp, omadmclient.exe, 00000025.00000002.528042949.00007FF6BFA68000.00000002.00000001.01000000.00000011.sdmp
                      Source: Binary string: omadmclient.pdbGCTL source: omadmclient.exe, 00000025.00000000.504473008.00007FF6BFA68000.00000002.00000001.01000000.00000011.sdmp, omadmclient.exe, 00000025.00000002.528042949.00007FF6BFA68000.00000002.00000001.01000000.00000011.sdmp
                      Source: Binary string: FileHistory.pdb source: FileHistory.exe, 00000015.00000000.378208348.00007FF6811E9000.00000002.00000001.01000000.00000009.sdmp, FileHistory.exe, 00000015.00000002.383485917.00007FF6811E9000.00000002.00000001.01000000.00000009.sdmp
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711ED10 FindFirstFileExW,0_2_00007FFC6711ED10
                      Source: C:\Users\user\AppData\Local\NYpervHTp\mspaint.exeCode function: 25_2_00007FFC74C6ED10 FindFirstFileExW,25_2_00007FFC74C6ED10
                      Source: C:\Users\user\AppData\Local\vVin\unregmp2.exeCode function: 35_2_00007FF672546088 FindFirstFileW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,FindNextFileW,FindClose,RegOpenKeyExW,LoadStringW,RegQueryValueExW,LoadStringW,RegCloseKey,PathAddBackslashW,GetFileAttributesW,RegOpenKeyExW,LoadStringW,RegQueryValueExW,PathAddBackslashW,GetFileAttributesW,RegCloseKey,RegCloseKey,LoadStringW,PathAddBackslashW,GetFileAttributesW,LoadStringW,PathAddBackslashW,GetFileAttributesW,wcsrchr,LoadStringW,PathAddBackslashW,GetFileAttributesW,RegOpenKeyExW,LoadStringW,RegQueryValueExW,PathAddBackslashW,GetFileAttributesW,RegCloseKey,RegCloseKey,LoadStringW,PathAddBackslashW,GetFileAttributesW,LoadStringW,PathAddBackslashW,GetFileAttributesW,wcsrchr,35_2_00007FF672546088
                      Source: C:\Users\user\AppData\Local\vVin\unregmp2.exeCode function: 35_2_00007FF672545B4C PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,35_2_00007FF672545B4C
                      Source: C:\Users\user\AppData\Local\vVin\unregmp2.exeCode function: 35_2_00007FF672548BFC CoInitialize,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,CoUninitialize,35_2_00007FF672548BFC
                      Source: C:\Users\user\AppData\Local\vVin\unregmp2.exeCode function: 35_2_00007FF6725472E8 RegOpenKeyExW,RegQueryValueExW,SHChangeNotify,RegDeleteValueW,wcsrchr,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,RegQueryValueExW,RegCloseKey,35_2_00007FF6725472E8
                      Source: C:\Users\user\AppData\Local\vVin\unregmp2.exeCode function: 35_2_00007FF6725479C4 SHGetSpecialFolderPathW,PathRemoveFileSpecW,PathRemoveFileSpecW,LoadStringW,PathRemoveFileSpecW,PathAppendW,PathIsDirectoryW,PathRemoveFileSpecW,PathAppendW,PathAppendW,PathAddBackslashW,GetShortPathNameW,SHGetFolderPathW,PathAddBackslashW,GetShortPathNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,PathRemoveBlanksW,_wcsicmp,FindNextFileW,FindClose,SHChangeNotify,SetCurrentDirectoryW,35_2_00007FF6725479C4
                      Source: GamePanel.exeString found in binary or memory: https://MediaData.XboxLive.com/broadcasts/Augment
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://MediaData.XboxLive.com/broadcasts/Augmenthttps://MediaData.XboxLive.com/screenshots/Augmenth
                      Source: GamePanel.exeString found in binary or memory: https://MediaData.XboxLive.com/gameclips/Augment
                      Source: GamePanel.exeString found in binary or memory: https://MediaData.XboxLive.com/screenshots/Augment
                      Source: GamePanel.exeString found in binary or memory: https://aka.ms/ifg0es
                      Source: GamePanel.exeString found in binary or memory: https://aka.ms/imfx4k
                      Source: GamePanel.exeString found in binary or memory: https://aka.ms/imrx2o
                      Source: GamePanel.exeString found in binary or memory: https://aka.ms/v5do45
                      Source: GamePanel.exeString found in binary or memory: https://aka.ms/w5ryqn
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://aka.ms/w5ryqnhttps://aka.ms/imfx4kQUITTING
                      Source: GamePanel.exe, GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://aka.ms/wk9ocd
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/%ws
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://mixer.com/%wsWindows.System.Launcher
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/_latest/assets/emoticons/%ls.png
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://mixer.com/_latest/assets/emoticons/%ls.pngtitleIdaumIdkglIdprocessNamenametypeIdmultimedia
                      Source: GamePanel.exe, GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://mixer.com/api/v1/broadcasts/current
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/api/v1/channels/%d
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/api/v1/channels/%ws
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/api/v1/chats/%.0f
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://mixer.com/api/v1/chats/%.0fhttps://mixer.com/api/v1/users/currentBEAM_IMAGEGamesGuide::BeamC
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/api/v1/oauth/xbl/login
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/api/v1/types/lookup%ws
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://mixer.com/api/v1/types/lookup%wshttps://mixer.com/api/v1/channels/%wshttps://mixer.com/api/v
                      Source: GamePanel.exeString found in binary or memory: https://mixer.com/api/v1/users/current
                      Source: GamePanel.exeString found in binary or memory: https://profile.xboxlive.com/users/me/profile/settings?settings=GameDisplayPicRaw
                      Source: GamePanel.exeString found in binary or memory: https://www.xboxlive.com
                      Source: GamePanel.exe, 00000029.00000000.542785985.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmp, GamePanel.exe, 00000029.00000002.566549316.00007FF76CAB7000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://www.xboxlive.comMBI_SSLhttps://profile.xboxlive.com/users/me/profile/settings?settings=GameD
                      Source: C:\Users\user\AppData\Local\Odp\GamePanel.exeCode function: 41_2_00007FF76CAA45E0 UiaReturnRawElementProvider,GetRawInputData,GetMessageExtraInfo,GetMessageExtraInfo,SendMessageW,SendMessageW,MulDiv,#413,Concurrency::cancel_current_task,41_2_00007FF76CAA45E0

                      E-Banking Fraud

                      barindex
                      Source: Yara matchFile source: 8.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 35.2.unregmp2.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 21.2.FileHistory.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.2.omadmclient.exe.7ffc74c20000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 41.2.GamePanel.exe.7ffc678e0000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 25.2.mspaint.exe.7ffc74c10000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 2.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.loaddll64.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.rundll32.exe.7ffc670c0000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000002.254650738.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.274237724.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.268092209.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000023.00000002.497477137.00007FFC74C21000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.260480210.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000002.00000002.363013775.00007FFC670C1000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000029.00000002.566763440.00007FFC678E1000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000019.00000002.457997826.00007FFC74C11000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.528095549.00007FFC74C21000.00000020.00000001.01000000.00000012.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000015.00000002.383767376.00007FFC74C21000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671097D00_2_00007FFC671097D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F50200_2_00007FFC670F5020
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711DDC00_2_00007FFC6711DDC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671276500_2_00007FFC67127650
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712D5200_2_00007FFC6712D520
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6710A2C00_2_00007FFC6710A2C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F59F00_2_00007FFC670F59F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FAA700_2_00007FFC670FAA70
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6710CA500_2_00007FFC6710CA50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E78800_2_00007FFC670E7880
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671131500_2_00007FFC67113150
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713B7A00_2_00007FFC6713B7A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C67900_2_00007FFC670C6790
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712C7800_2_00007FFC6712C780
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713EF800_2_00007FFC6713EF80
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EE7B00_2_00007FFC670EE7B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DA7D00_2_00007FFC670DA7D0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67134FF00_2_00007FFC67134FF0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D8FC00_2_00007FFC670D8FC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E6FE00_2_00007FFC670E6FE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C10100_2_00007FFC670C1010
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E48000_2_00007FFC670E4800
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EC0300_2_00007FFC670EC030
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F00200_2_00007FFC670F0020
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E50500_2_00007FFC670E5050
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6710F8700_2_00007FFC6710F870
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671158400_2_00007FFC67115840
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FF8700_2_00007FFC670FF870
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C6E900_2_00007FFC670C6E90
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712A6B00_2_00007FFC6712A6B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C7E800_2_00007FFC670C7E80
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EF6B00_2_00007FFC670EF6B0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F06A00_2_00007FFC670F06A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67127EC00_2_00007FFC67127EC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67120F300_2_00007FFC67120F30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E872B0_2_00007FFC670E872B
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671257600_2_00007FFC67125760
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E2F500_2_00007FFC670E2F50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6713BF6F0_2_00007FFC6713BF6F
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671207700_2_00007FFC67120770
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670DE7700_2_00007FFC670DE770
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CC5A00_2_00007FFC670CC5A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D95C00_2_00007FFC670D95C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F25C00_2_00007FFC670F25C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D65E00_2_00007FFC670D65E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E36100_2_00007FFC670E3610
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F2E100_2_00007FFC670F2E10
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CDE200_2_00007FFC670CDE20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C16200_2_00007FFC670C1620
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D86700_2_00007FFC670D8670
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671106500_2_00007FFC67110650
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E49D0_2_00007FFC6712E49D
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67122CA00_2_00007FFC67122CA0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4A60_2_00007FFC6712E4A6
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4AD0_2_00007FFC6712E4AD
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4B60_2_00007FFC6712E4B6
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EAC800_2_00007FFC670EAC80
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E48B0_2_00007FFC6712E48B
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712A4900_2_00007FFC6712A490
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4940_2_00007FFC6712E494
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D3CD00_2_00007FFC670D3CD0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F5CD00_2_00007FFC670F5CD0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F3CF00_2_00007FFC670F3CF0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F0D100_2_00007FFC670F0D10
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F1D300_2_00007FFC670F1D30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E3D500_2_00007FFC670E3D50
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670ED5500_2_00007FFC670ED550
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D9D700_2_00007FFC670D9D70
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671243900_2_00007FFC67124390
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67114BC00_2_00007FFC67114BC0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D23F00_2_00007FFC670D23F0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D74100_2_00007FFC670D7410
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712E4000_2_00007FFC6712E400
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671294100_2_00007FFC67129410
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D54200_2_00007FFC670D5420
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C5C200_2_00007FFC670C5C20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC671282A00_2_00007FFC671282A0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6712AAA00_2_00007FFC6712AAA0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EDAA00_2_00007FFC670EDAA0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67122AE00_2_00007FFC67122AE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC67127AF00_2_00007FFC67127AF0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E92C00_2_00007FFC670E92C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC6711F2C00_2_00007FFC6711F2C0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E82E00_2_00007FFC670E82E0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670FBAE00_2_00007FFC670FBAE0
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670EA3100_2_00007FFC670EA310
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F03000_2_00007FFC670F0300
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670F1B300_2_00007FFC670F1B30
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670CBB200_2_00007FFC670CBB20
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670C53500_2_00007FFC670C5350
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670E33400_2_00007FFC670E3340
                      Source: C:\Windows\System32\loaddll64.exeCode function: 0_2_00007FFC670D83400_2_00007FFC670D8340
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C55CD021_2_00007FFC74C55CD0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C7DDC021_2_00007FFC74C7DDC0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C5502021_2_00007FFC74C55020
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C6CA5021_2_00007FFC74C6CA50
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C5AA7021_2_00007FFC74C5AA70
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C6A2C021_2_00007FFC74C6A2C0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4D55021_2_00007FFC74C4D550
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C43D5021_2_00007FFC74C43D50
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C39D7021_2_00007FFC74C39D70
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C50D1021_2_00007FFC74C50D10
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C51D3021_2_00007FFC74C51D30
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C8D52021_2_00007FFC74C8D520
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C33CD021_2_00007FFC74C33CD0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C53CF021_2_00007FFC74C53CF0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4AC8021_2_00007FFC74C4AC80
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C82CA021_2_00007FFC74C82CA0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C7065021_2_00007FFC74C70650
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C8765021_2_00007FFC74C87650
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C3867021_2_00007FFC74C38670
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C52E1021_2_00007FFC74C52E10
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4361021_2_00007FFC74C43610
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C2162021_2_00007FFC74C21620
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C2DE2021_2_00007FFC74C2DE20
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C525C021_2_00007FFC74C525C0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C395C021_2_00007FFC74C395C0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C365E021_2_00007FFC74C365E0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C2C5A021_2_00007FFC74C2C5A0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C42F5021_2_00007FFC74C42F50
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C8077021_2_00007FFC74C80770
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C3E77021_2_00007FFC74C3E770
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C8576021_2_00007FFC74C85760
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C80F3021_2_00007FFC74C80F30
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4872B21_2_00007FFC74C4872B
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C87EC021_2_00007FFC74C87EC0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C26E9021_2_00007FFC74C26E90
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C27E8021_2_00007FFC74C27E80
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4F6B021_2_00007FFC74C4F6B0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C506A021_2_00007FFC74C506A0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4505021_2_00007FFC74C45050
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C7584021_2_00007FFC74C75840
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C5F87021_2_00007FFC74C5F870
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C2101021_2_00007FFC74C21010
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4480021_2_00007FFC74C44800
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4C03021_2_00007FFC74C4C030
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C5002021_2_00007FFC74C50020
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C697D021_2_00007FFC74C697D0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C3A7D021_2_00007FFC74C3A7D0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C38FC021_2_00007FFC74C38FC0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C94FF021_2_00007FFC74C94FF0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C46FE021_2_00007FFC74C46FE0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C2679021_2_00007FFC74C26790
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C9EF8021_2_00007FFC74C9EF80
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4E7B021_2_00007FFC74C4E7B0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C9B7A021_2_00007FFC74C9B7A0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C7315021_2_00007FFC74C73150
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C8695021_2_00007FFC74C86950
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4414021_2_00007FFC74C44140
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C8B96021_2_00007FFC74C8B960
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C3E11021_2_00007FFC74C3E110
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C4391021_2_00007FFC74C43910
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C2B10021_2_00007FFC74C2B100
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C5613021_2_00007FFC74C56130
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.exeCode function: 21_2_00007FFC74C218D021_2_00007FFC74C218D0
                      Source: C:\Users\user\AppData\Local\u70W8\FileHistory.ex